EUVD-2026-57532

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-57531

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-73414 Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-73414 Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-73414

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-73414

Shescape (JavaScript library) contains a vulnerability in getEscapeFunction (src/internal/win/cmd.js) where it fails to escape '(' and ')' when using escape/escapeAll on Windows with CMD or with shell: true when CMD is default. An attacker-controlled argument can break out of a parenthesized CMD ...

EUVD-2026-57525

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73412 Shescape: Path disclosure on Unix with Zsh

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73412

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73412 Shescape: Path disclosure on Unix with Zsh

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73412

Shescape (JavaScript) prior to versions 2.1.14 and 3.0.1 is vulnerable on Unix when the shell is Zsh or the default shell is Zsh, affecting the escape and escapeAll functions. The issue is associated with Zsh options EXTENDED_GLOB and MAGIC_SUBST, enabling home-directory expansion or extended glo...

CVE-2026-73412 Shescape: Path disclosure on Unix with Zsh

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73411

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

EUVD-2026-57518

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411

Vulnerability summary (CVE-2026-73411) : The Shescape JavaScript library is affected by a flaw in getEscapeFunction (src/internal/unix/dash.js) prior to versions 2.1.14 and 3.0.1. When using escape or escapeAll APIs on Unix with shell set to dash (or shell=true when Dash is default), the code fai...

CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

GHSA-49M4-VP58-WGC9 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

Stata Command Injection via Unsanitized package in adopackageinstall Summary The adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python...

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

Stata Command Injection via Unsanitized package in adopackageinstall Summary The adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python...