GHSA-6V4M-FW66-8R4X: Root-cause Fix for Shell Expansion Escaping in Shescape

Vulnerability

GHSA-6V4M-FW66-8R4X describes escaping failures in Shescape where shell-significant characters were not neutralized in contexts that still trigger shell parsing. The supplied diffs show three concrete classes of issues.

First, Windows CMD did not escape parentheses. In src/internal/win/cmd.js, the vulnerable matcher only covered % & < > ^ |, omitting ( and ). In CMD, parentheses are control syntax, so leaving them unescaped permits syntax breakout even when adjacent to otherwise benign text.

Second, Unix handling for Dash and Zsh under-modeled expansion boundaries. In Dash, ~ was only recognized after start-of-string or whitespace, via /(^|\s)~/g, but the patch broadens this to /(^|[\s:=])~/g. In Zsh, expansion handling similarly moved away from whitespace-only detection. This is consistent with the advisory summary that punctuation-adjacent placement could still trigger shell expansion and path disclosure.

Third, Zsh escaping was incomplete for shells with EXTENDED_GLOB. The patch removes the separate comment-specific handling and instead expands the general special-character class to include #, ^, and ~, while narrowing expansion-specific escaping to =. The tests added for #, ^, and multiple ~/= combinations indicate the original implementation underestimated Zsh metacharacter behavior.

// Windows CMD before/after
const specials = new RegExp(/([%&<>^|])/g);
const specials = new RegExp(/([%&()<>^|])/g);

// Dash before/after
const home = new RegExp(/(^|\s)~/g);
const home = new RegExp(/(^|[\s:=])~/g);

Relevant sources: PR #2649, PR #2651, commit 43d70b5, commit b4b34c3.

Patch

The patch makes targeted escaping corrections in the shell-specific backends and one structural change in composition logic.

For CMD, src/internal/win/cmd.js now escapes parentheses by changing the special-character regex from /([%&<>^|])/g to /([%&()<>^|])/g. The Windows fixtures were updated so inputs like a(b now expect a^(b, and similarly for closing parentheses. This directly addresses the syntax breakout vector documented in the advisory.

For Dash, src/internal/unix/dash.js broadens tilde detection from whitespace-only to [\s:=]-prefixed contexts. That change is important because shell expansion can still occur after punctuation such as = and :, not just after spaces.

For Zsh, the patch is more substantial. The old implementation had a dedicated comment regex and an expansion regex for both = and ~. The new implementation removes the comment-specific replacement, narrows expansion handling to =, and expands the general specials class to include #, ^, and ~. That shifts protection from context-sensitive handling of ~ and # toward unconditional escaping in Zsh, which is a safer default when EXTENDED_GLOB semantics are in play.

The compose-layer change in src/internal/compose.js replaces iterative destructuring over the original argument with indexed traversal over flagFn(arg) fragments. The associated unit test change from asserting escapeFn(input) to escapeFn(flagResult) indicates the previous test oracle did not match the intended data flow. This is not the primary security fix, but it reduces the chance that flag protection skips the wrong prefix segment.

// Zsh before/after
const comments = new RegExp(/(^|\s)#/g);
const expansions = new RegExp(/(^|[\s:=])([=~])/g);
const specials = new RegExp(/(["$&'()*;<>?[\]`{|}])/g);

const expansions = new RegExp(/(^|[\s:=])=/g);
const specials = new RegExp(/(["#$&'()*;<>?[\]^`{|}~])/g);

Patch references: PR #2649 and PR #2651.

Review

Pros

• The CMD fix is precise and directly maps to the disclosed breakout primitive: parentheses are now escaped in src/internal/win/cmd.js.
• The Dash change broadens the trigger context for tilde escaping from whitespace-only to punctuation-aware matching, which aligns with the advisory's punctuation-adjacent bypass description.
• The Zsh fix strengthens protection under EXTENDED_GLOB by adding #, ^, and ~ to the general specials set instead of relying on narrower contextual rules.
• Regression coverage improved materially. The fixtures now include cases for a=~, a=b:~, repeated ~ segments, repeated #, and caret handling, plus Windows parenthesis cases.
• The compose test correction suggests the maintainers validated the actual fragment-processing contract rather than the raw input, reducing false confidence in the protection layer.

Cons

• The patch is regex-driven and shell-specific, so long-term robustness still depends on accurately modeling each shell grammar. That is inherently brittle for command construction libraries.
• The provided diffs show duplicated fixture blocks in test/fixtures/unix.js, which may be an artifact of the digest, but if representative of the actual patch review surface it makes validation harder.
• The compose-layer optimization is security-adjacent but not obviously tied to the advisory exploit path from the snippets alone; it increases review scope and deserves separate reasoning or tests demonstrating why fragment-based processing is required for safety.
• The Zsh strategy changes from context-sensitive escaping of ~ to inclusion in the general specials class. That is safer, but it may alter output compatibility for callers that depended on previous minimal escaping behavior.

Verdict

Root-cause.

Based on the supplied sources, the patch addresses the underlying cause rather than merely blocking one proof-of-concept. The vulnerable behavior came from incomplete shell metacharacter modeling and overly narrow context detection. The fix expands the escaped character sets for CMD and Zsh, broadens Dash/Zsh expansion boundary recognition, and adds regression tests that exercise the punctuation-adjacent cases called out in the advisory. While regex-based shell escaping remains a high-risk design space, the specific gaps disclosed in GHSA-6V4M-FW66-8R4X appear to be comprehensively covered by the patch set in 43d70b5 and b4b34c3.