CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescapeescape does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like...

CVE-2026-32094

creationtimestamp| type| source ---|---|--- 2026-03-10 20:00:28+00:00| published-proof-of-concept| https://github.com/ericcornelissen/shescape/security/advisories/GHSA-9jfh-9xrq-4vwm 2026-03-11 19:16:17+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-32094...