The shescape library fails to escape parentheses in its Windows‑cmd‑specific escape logic, allowing an attacker‑controlled argument to break out of a parenthesized CMD construct and inject arbitrary shell syntax. This results in OS command injection, which can be used to execute commands with the privileges of the running process. The weakness is recognized under CWE‑78 (OS Command Injection) and CWE‑150 (Race Condition in Shell Command Execution).

The vulnerable product is the Shescape JavaScript shell‑escape library produced by ericcornelissen. Versions older than 2.1.14 of the 2.x branch and older than 3.0.1 of the 3.x branch are affected. These releases expose the bug when the library is used on Windows environments that employ CMD as the shell or when the shell is set to true and defaults to CMD.

With a CVSS score of 9.2 the vulnerability is considered critical. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Attackers would need to supply crafted input to a JavaScript application that calls shescape on Windows, which is a realistic scenario in many Node.js deployments. The potential impact includes full control of the execution environment, and because the vulnerability exists in a widely used utility library, it could be exploited by automated tools or by an attacker who compromises a user’s input.