CVE-2026-32094: Shescape Package Vulnerability Allows Argument Injection via Bracket Glob Expansion
Summary
CVE-2026-32094: Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash. Affects shescape versions < 2.1.10. Fixed in 2.1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shescape is an npm package designed to safely escape shell command arguments for various Unix shells, including Bash, BusyBox, and Dash. It provides a utility for developers to ensure that user input does not inadvertently alter command execution. However, a recent vulnerability has been identified that allows for bracket glob expansion, potentially leading to unintended command behavior.
Vulnerability Detail
The vulnerability arises from the Shescape#escape() function, which fails to escape square-bracket glob syntax for Bash, BusyBox, and Dash shells. This oversight allows an attacker to inject values like 'secret[12]', which can expand into multiple filesystem matches instead of being treated as a single literal argument. This can lead to argument injection, where a single untrusted argument can result in multiple pathname matches from the trusted filesystem, potentially altering command behavior, targeting unintended files, or leaking sensitive filenames.
How To Fix
Minimum fixed version
2.1.10
This is the first release that contains the fix.
npm install shescape@2.1.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Shescape#escape() function for any input that may contain square brackets when executing commands in Bash, BusyBox, or Dash. Instead, consider manually escaping the input or using alternative methods to sanitize user input.
Conclusion
The Shescape package has a vulnerability (CVE-2026-32094) that allows for argument injection due to improper handling of square-bracket glob syntax. Users are advised to update to version 2.1.10 or later to mitigate this risk. For those unable to update immediately, alternative workarounds should be considered.
See every vulnerability recorded for shescape →
FAQ
The vulnerability allows for bracket glob expansion, which can lead to argument injection when untrusted input is processed.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
The consequences include unintended command behavior, targeting of unintended files, and potential leakage of sensitive filenames.
Yes, a patch is available in version 2.1.10 of the Shescape package. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, consider implementing manual input sanitization or avoiding the use of Shescape#escape() for inputs containing square brackets.
References
Related vulnerabilities
Recent vulnerabilities recorded for shescape.
