Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 https://dailycve.com/shescape-argument-injection-via-unescaped-glob-syntax-#cve-2026-32094-medium/ Quill SSRF Vulnerability CVE-2024-XXXX (High)
Post summary
The text announces two CVEs with their severity levels but provides no further technical detail, PoC, or mitigation information.
CVE-2026-32094 Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash… https://www.cve.org/CVERecord?id=CVE-2026-32094
Post summary
The post discloses that Shescape’s escape function misses escaping square‑bracket glob syntax for several shells, but does not provide any PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shescape_project | shescape | - | node.js | - |