NPM · JULY 2026 · EARLY WARNING

Shescape npm Package Vulnerability: Shell Injection on Windows CMD

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
shescape (npm)
Affected versions
< 1.7.1 or >= 1.4.0, < 1.5.1 or >= 1.4.0, < 1.5.8 or >= 1.7.2, < 2.1.2 or < 2.1.14 or >= 3.0.0, < 3.0.1 or < 2.1.10 or >= 1.5.10, < 1.6.1 or < 1.1.3 or >= 2.1.11, < 2.1.14 or >= 3.0.0, < 3.0.1 or < 1.7.4 or < 1.5.8 or < 2.1.14 or >= 3.0.0, < 3.0.1 or < 2.1.14 or >= 3.0.0, < 3.0.1
Patched version
v2.1.14,v3.0.1
GHSA-W4HW-QCX7-56PR

An early warning has been issued for a high-severity vulnerability in the Shescape npm package. The vulnerability may allow shell injection via unescaped parentheses on Windows with CMD.

What happened

The Shescape npm package is reportedly vulnerable to shell injection due to unescaped parentheses on Windows with CMD. This can potentially allow an attacker to achieve shell injection depending on the original command. The vulnerability has been patched in versions v2.1.14 and v3.0.1. The issue was first flagged on 2026-07-24T22:34:23+00:00.

Affected versions include < 1.7.1 or >= 1.4.0, < 1.5.1 or >= 1.4.0, < 1.5.8 or >= 1.7.2, < 2.1.2 or < 2.1.14 or >= 3.0.0, < 3.0.1 or < 2.1.10 or >= 1.5.10, < 1.6.1 or < 1.1.3 or >= 2.1.11, < 2.1.14 or >= 3.0.0, < 3.0.1 or < 1.7.4 or < 1.5.8 or < 2.1.14 or >= 3.0.0, < 3.0.1 or < 2.1.14 or >= 3.0.0, < 3.0.1. Users of these versions are advised to upgrade.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If shescape is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using Shescape npm package versions < 1.7.1 or >= 1.4.0, < 1.5.1 or >= 1.4.0, < 1.5.8 or >= 1.7.2, < 2.1.2 or < 2.1.14 or >= 3.0.0, < 3.0.1 or < 2.1.10 or >= 1.5.10, < 1.6.1 or < 1.1.3 or >= 2.1.11, < 2.1.14 or >= 3.0.0, < 3.0.1 or < 1.7.4 or < 1.5.8 or < 2.1.14 or >= 3.0.0, < 3.0.1 or < 2.1.14 or >= 3.0.0, < 3.0.1.

What should I do right now?

Upgrade to Shescape v2.1.14 or v3.0.1. If you are already using v3, no further changes are required. If you are using v2, follow the migration guide to upgrade to v3.

Has this been exploited in the wild?

There is no report of this vulnerability being exploited in the wild at this time.

Sources

Join the 0Day waitlist →

← Back to all threats