https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 03:34:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275877 EUVD-2026-275877 https://cve.radiocsirt.org/vuln/euvd-2026-275877 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32094 <p>Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.</p> <p>Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32094 https://cve.radiocsirt.org/vuln/ghsa-9jfh-9xrq-4vwm <p><strong>Affected:</strong> npm: shescape</p> <p>### Summary</p> <p>`Shescape#escape()` does not escape square-bracket glob syntax for Bash, BusyBox `sh`, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like `secret[12]` to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches.</p> <p>### Details</p> <p>The unquoted Unix escape helpers never add `[` or `]` to their “special characters” regexes:</p> <p>- `src/internal/unix/bash.js:14-30` - `src/internal/unix/busybox.js:14-30` - `src/internal/unix/dash.js:12-19`</p> <p>They escape `*`/`?` but not brackets, so `new Shescape({ shell: &#34;/usr/bin/bash&#34; }).escape(&#34;secret[12]&#34;)` still produces `secret[12]`. The fixtures (`test/fixtures/unix.js:2236-2265`, `3496-3525`, `5762-5792`) are currently written to expect literal brackets for these shells, confirming the behavior. The documentation recommends `Shescape#escape()` as the fallback for `exec` when quoting isn’t possible (`docs/recipes.md:154-183`).</p> <p>### Proof of Concept</p> <p>Use the published npm tarball without modifications:</p> <p>```shell tmp=$(mktemp -d) cd &#34;$tmp&#34; npm pack shescape@2.1.9 &gt;/dev/null mkdir pkg tar -xzf shescape-2.1.9.tgz -C pkg cd pkg/package npm install --omit=dev</p> <p>node --input-type=module - &lt;&lt;&#39;NODE&#39; import { mkdtempSync, writeFileSync } from &#34;node:fs&#34;; import { tmpdir } from &#34;node:os&#34;; import path from &#34;node:path&#34;; import { execSync } from &#34;node:child_process&#34;; import { Shescape }…</p> <p><strong>Affected:</strong> npm: shescape</p> <p>### Summary</p> <p>`Shescape#escape()` does not escape square-bracket glob syntax for Bash, BusyBox `sh`, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like `secret[12]` to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches.</p> <p>### Details</p> <p>The unquoted Unix escape helpers never add `[` or `]` to their “special characters” regexes:</p> <p>- `src/internal/unix/bash.js:14-30` - `src/internal/unix/busybox.js:14-30` - `src/internal/unix/dash.js:12-19`</p> <p>They escape `*`/`?` but not brackets, so `new Shescape({ shell: &#34;/usr/bin/bash&#34; }).escape(&#34;secret[12]&#34;)` still produces `secret[12]`. The fixtures (`test/fixtures/unix.js:2236-2265`, `3496-3525`, `5762-5792`) are currently written to expect literal brackets for these shells, confirming the behavior. The documentation recommends `Shescape#escape()` as the fallback for `exec` when quoting isn’t possible (`docs/recipes.md:154-183`).</p> <p>### Proof of Concept</p> <p>Use the published npm tarball without modifications:</p> <p>```shell tmp=$(mktemp -d) cd &#34;$tmp&#34; npm pack shescape@2.1.9 &gt;/dev/null mkdir pkg tar -xzf shescape-2.1.9.tgz -C pkg cd pkg/package npm install --omit=dev</p> <p>node --input-type=module - &lt;&lt;&#39;NODE&#39; import { mkdtempSync, writeFileSync } from &#34;node:fs&#34;; import { tmpdir } from &#34;node:os&#34;; import path from &#34;node:path&#34;; import { execSync } from &#34;node:child_process&#34;; import { Shescape }…</p> https://cve.radiocsirt.org/vuln/ghsa-9jfh-9xrq-4vwm