CVE-2026-32094

The record

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.

Affected packages

Related vulnerabilities

• GHSA-9jfh-9xrq-4vwm Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash Same vulnerability
• CVE-2026-30916 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Also affects shescape
• GHSA-6f6w-6j58-rq76 Withdrawn Advisory: Shescape has possible misidentification of shell due to link chains Also affects shescape
• CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
• CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
• CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
• CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
• CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200