CVE-2026-32094: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32094 is an argument injection vulnerability in the Shescape npm library where the escape() function fails to escape square-bracket glob syntax ([ and ]) for Bash, BusyBox sh, and Dash shells. This allows a single untrusted argument to expand into multiple pathname matches from the filesystem when interpolated into a shell command string. All versions of Shescape prior to 2.1.10 for Node.js are affected. The advisory was published on March 10, 2026, with a CVSS v4.0 base score of 6.9 (Medium) and a CVSS v3.1 score of 6.5 (Medium) (Github Advisory, Shescape Advisory).

The root cause is an incomplete special-character regex in the unquoted Unix escape helpers for Bash (src/internal/unix/bash.js), BusyBox (src/internal/unix/busybox.js), and Dash (src/internal/unix/dash.js). These regexes escape *, /, and ? but omit [ and ], meaning a call like new Shescape({ shell: "/usr/bin/bash" }).escape("secret[12]") returns the unmodified string secret[12] rather than the correctly escaped secret\[12\]. When an application interpolates this output directly into a shell command string (as recommended in the Shescape documentation for exec use cases), the shell performs bracket glob expansion, causing one argument to match multiple filesystem pathnames (CWE-200). The vulnerability requires no authentication or special privileges and is exploitable over the network by any application that accepts untrusted input and passes it through the affected escape() function (Shescape Advisory, Fix Commit).

Successful exploitation allows an unauthenticated network attacker to cause a single controlled argument to expand into multiple filesystem pathname matches, potentially changing the behavior of shell commands, targeting unintended files, or leaking sensitive filenames from the server's filesystem. The confidentiality impact is low (partial filename disclosure) and the integrity impact is low (unintended files may be processed by commands), with no direct availability impact. The scope of affected assets is limited to applications using Shescape's escape() with Bash, BusyBox, or Dash shells that interpolate the result unsafely into shell command strings (Github Advisory, Shescape Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, consisting of runnable Node.js code that demonstrates bracket glob expansion by creating test files and executing shell commands via execSync (Shescape Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042–0.056% (18th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a vulnerable application: Find a Node.js application that uses shescape version < 2.1.10 with Bash, BusyBox, or Dash as the shell, and that accepts user-controlled input passed to Shescape#escape() with the result interpolated directly into a shell command string.
2. Craft a malicious glob argument: Prepare an input string containing square-bracket glob syntax, such as secret[12], where secret1 and secret2 are known or guessable filenames on the target server's filesystem.
3. Submit the malicious input: Send the crafted argument to the application via its normal input channel (e.g., HTTP request parameter, form field, API call).
4. Trigger glob expansion: Because escape() does not escape [ or ], the shell receives secret[12] unescaped. When the shell evaluates the command, it performs glob expansion, matching both secret1 and secret2 as separate arguments instead of the literal string secret[12].
5. Achieve objective: Depending on the command being executed, the attacker can cause the command to operate on unintended files (integrity impact), enumerate filenames that match the glob pattern (confidentiality/information disclosure), or alter command behavior by injecting additional arguments (Shescape Advisory).

• Logs: Application logs showing shell commands receiving unexpected multiple arguments where a single argument was intended; error messages from commands failing due to unexpected extra file arguments.
• File System: Evidence of commands operating on unintended files (e.g., unexpected file reads, modifications, or deletions matching glob patterns like secret[12]).
• Process: Shell processes (bash, dash, busybox sh) spawned by a Node.js application with argument lists containing bracket-pattern strings that were not properly escaped (e.g., arguments like secret[12] appearing in process command lines rather than secret\[12\]).
• Network: Unusual or repeated requests to application endpoints that accept user-controlled arguments, particularly inputs containing [ and ] characters, originating from unexpected sources.

Upgrade Shescape to version 2.1.10 or later, which corrects the escaping of [ and ] characters for Bash, BusyBox, and Dash shells by adding them to the special-characters regex in the respective escape helpers (Shescape Release, Fix Commit). As a workaround prior to patching, applications should validate and sanitize user input to reject or strip [ and ] characters before passing them to escape(), or switch to using Shescape#quote() (which wraps arguments in quotes) instead of escape() where possible. Developers should also audit any code paths that interpolate Shescape-escaped values directly into shell command strings rather than passing them as separate arguments to execFile or similar APIs (Shescape Advisory).