DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-W4HW-QCX7-56PR: GHSA-W4HW-QCX7-56PR: OS Command Injection in Shescape via Unescaped Parentheses on Windows CMD

#security #cve #cybersecurity #ghsa

GHSA-W4HW-QCX7-56PR: OS Command Injection in Shescape via Unescaped Parentheses on Windows CMD

Vulnerability ID: GHSA-W4HW-QCX7-56PR
CVSS Score: 9.2
Published: 2026-07-24

A critical command injection vulnerability in the shescape npm library affects Windows systems when running shell commands using cmd.exe. The escaping function fails to neutralize parentheses, allowing attackers to close shell blocks and execute arbitrary commands.

TL;DR

Unescaped parentheses in shescape on Windows allow attackers to bypass shell escaping and execute arbitrary OS commands when input is processed within parenthesized cmd.exe blocks.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-78, CWE-150
  • Attack Vector: Network
  • CVSS Score: 9.2 (Critical)
  • EPSS Score: N/A
  • Impact: Arbitrary Code Execution (RCE)
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • Windows systems running Node.js applications that utilize shescape to escape arguments for cmd.exe
  • shescape: < 2.1.14 (Fixed in: 2.1.14)
  • shescape: >= 3.0.0, < 3.0.1 (Fixed in: 3.0.1)

Code Analysis

Commit: 43d70b5

Escape parentheses on Windows with CMD; enforce robust escaping in Unix shells

diff --git a/src/internal/win/cmd.js b/src/internal/win/cmd.js\n@@ -4,3 +4,3 @@\n-  const specials = new RegExp(/([%&<>^|])/g);\n+  const specials = new RegExp(/([%&()<>^|])/g);
Enter fullscreen mode Exit fullscreen mode

Commit: b4b34c3

Backport escaping fix for parentheses on Windows CMD to v2 branch

diff --git a/src/internal/win/cmd.js b/src/internal/win/cmd.js\n@@ -4,3 +4,3 @@\n-  const specials = new RegExp(/([%&<>^|])/g);\n+  const specials = new RegExp(/([%&()<>^|])/g);
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade to patched version 2.1.14 or 3.0.1.
  • Filter and reject input containing parenthesis characters if running on Windows.
  • Avoid interpolating escaped strings into parenthesized shell script constructs.

Remediation Steps:

  1. Audit the codebase to find usages of shescape, identifying instances configured with cmd.exe or true shell.
  2. Execute 'npm install shescape@latest' or modify package.json to pin to >=2.1.14 or >=3.0.1.
  3. Verify the dependency tree and package-lock.json to ensure older versions are fully removed.
  4. Implement defensive coding practices, passing parameters as arguments rather than constructing dynamic shell commands.

References

Read the full report for GHSA-W4HW-QCX7-56PR on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)