OSEC-2026-24

See a problem?
Import Source
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-24.json
JSON Data
https://api.osv.dev/v1/vulns/OSEC-2026-24
Aliases
Published
2026-10-23T21:30:00Z
Modified
2026-10-23T22:25:39Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Multiple issues in command quoting on Windows
Details

ANT-2026-R7FKP7RG Win32 quote_cmd_filename misses pipe/redirect metacharacters

ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe_quote/make_cmdline

ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped

Also includes the fix for OSEC-2026-05

Filename.quote_command returns a quoted command line, suitable for use as an argument to Sys.command, Unix.system, and the Unix.open_process functions. However on Windows certain characters weren't properly escaped.

Unix.create_process can invoke .bat or .cmd programs on Windows, and certain characters were accepted that cannot be quoted safely.

Fix

Filename.quote_command has been updated to correctly quote arguments. Unix.create_process* has been updated to reject arguments that cannot be safely quoted by raising Failure:

if the program [prog] is a [.bat] or [.cmd] script and either [prog] or [args] contain characters that cannot be securely passed to a script, such as [" | & , ; < = > ^ % "]. If you really need to pass these characters to a script, consider using {!Unix.system} instead.

Am I affected?

If you use Filename.quote_command on Windows with user supplied arguments. If you use Unix.create_process* or Unix.open_process* on Windows with .bat or .cmd programs, and user supplied arguments.

Timeline

  • 2026-08-24: vulnerability was found
  • 2026-08-27: forwarded report to security@ocaml.org
  • 2029-09-05: fix merged to trunk
Database specific 
{
    "cwe":  [
        "CWE-78"
    ],
    "human_link":  "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-24.md",
    "osv":  "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-24.json"
}
Credits
    • Anthropic - REPORTER
    • Hannes Mehnert - COORDINATOR
    • Edwin Török - COORDINATOR
    • Nicolás Ojeda Bär - REMEDIATION_REVIEWER
    • Xavier Leroy - REMEDIATION_DEVELOPER

Affected packages

opam / ocaml

Package

Name
ocaml
Purl
pkg:opam/ocaml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.5.2
Type
GIT
Repo
https://github.com/ocaml/ocaml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
70a3a75c0bfb23d67ad5fe3e9c1ba9800d61feae
Type
GIT
Repo
https://github.com/ocaml/ocaml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0bbf8e5af985feb03a11a5ffe57d068373d09fd0

Affected versions

3.*
3.07
3.07+1
3.07+2
3.08.0
3.08.1
3.08.2
3.08.3
3.08.4
3.09.0
3.09.1
3.09.2
3.09.3
3.10.0
3.10.1
3.10.2
3.11.0
3.11.1
3.11.2
3.12.0
3.12.1
4.*
4.00.0
4.00.1
4.01.0
4.02.0
4.02.1
4.02.2
4.02.3
4.02.4
4.03.0
4.03.1
4.04.0
4.04.1
4.04.2
4.04.3
4.05.0
4.05.1
4.06.0
4.06.1
4.06.2
4.07.0
4.07.1
4.07.2
4.08.0
4.08.1
4.08.2
4.09.0
4.09.1
4.09.2
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.11.2
4.11.3
4.12.0
4.12.1
4.12.2
4.13.0
4.13.1
4.13.2
4.14.0
4.14.1
4.14.2
4.14.3
4.14.4
4.14.5
5.*
5.0.0
5.0.1
5.1.0
5.1.1
5.1.2
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha1
5.5.0-alpha2
5.5.0-alpha3
5.5.0-beta1
5.5.0-rc1
5.5.1
Other
flambda_fork_point

Ecosystem specific 

{
    "affected_bindings":  [
        "Filename.quote_command",
        "Unix.create_process",
        "Unix.create_process_env",
        "Unix.open_process_args_in",
        "Unix.open_process_args_out",
        "Unix.open_process_args_full"
    ],
    "opam_constraint":  "ocaml {< \"5.5.2\"}"
}

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-24.json"