Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.

Affected: npm: shescape

### Summary

`Shescape#escape()` does not escape square-bracket glob syntax for Bash, BusyBox `sh`, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like `secret[12]` to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches.

### Details

The unquoted Unix escape helpers never add `[` or `]` to their “special characters” regexes:

- `src/internal/unix/bash.js:14-30` - `src/internal/unix/busybox.js:14-30` - `src/internal/unix/dash.js:12-19`

They escape `*`/`?` but not brackets, so `new Shescape({ shell: "/usr/bin/bash" }).escape("secret[12]")` still produces `secret[12]`. The fixtures (`test/fixtures/unix.js:2236-2265`, `3496-3525`, `5762-5792`) are currently written to expect literal brackets for these shells, confirming the behavior. The documentation recommends `Shescape#escape()` as the fallback for `exec` when quoting isn’t possible (`docs/recipes.md:154-183`).

### Proof of Concept

Use the published npm tarball without modifications:

```shell tmp=$(mktemp -d) cd "$tmp" npm pack shescape@2.1.9 >/dev/null mkdir pkg tar -xzf shescape-2.1.9.tgz -C pkg cd pkg/package npm install --omit=dev

node --input-type=module - <<'NODE' import { mkdtempSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import path from "node:path"; import { execSync } from "node:child_process"; import { Shescape }…