GHSA-Q53C-4PRM-W95Q: Root-cause fix for shell escaping gaps in Shescape

Vulnerability

GHSA-Q53C-4PRM-W95Q describes escaping flaws in Shescape across multiple shell backends. The primary issue is a Unix path disclosure condition in Dash: tilde expansion was only recognized at start-of-string or after whitespace, so a value placed in an assignment context such as a=~ was emitted without escaping and could expand to the current user's home directory. That is a parser-context bug, because Dash treats ~ specially after assignment separators, not just after whitespace.

The same patch series also addresses secondary escaping gaps in Zsh and Windows CMD. In Zsh, the prior implementation separately handled comments and a narrow expansion pattern, but did not comprehensively escape characters that become special under EXTENDED_GLOB, notably #, ^, and ~. In CMD, parentheses were omitted from the escaped metacharacter set, leaving command composition vulnerable in contexts where grouping characters are interpreted by the shell.

// Dash before/after
const home = new RegExp(/(^|\s)~/g);
const home = new RegExp(/(^|[\s:=])~/g);

// CMD before/after
const specials = new RegExp(/([%<>^|])/g);
const specials = new RegExp(/([%&()<>^|])/g);

These changes are visible in the published commits and pull requests: commit 43d70b5, commit b4b34c3, PR #2649, and PR #2651.

Patch

The Dash fix broadens the tilde-detection regex from (^|\s)~ to (^|[\s:=])~, explicitly covering assignment and colon-delimited contexts that can trigger home expansion. The fixture additions show the intended behavior for cases like a=~, a=:~, a=b:~, and a=~/, which now escape the tilde rather than allowing expansion.

The Zsh fix is more substantial. The implementation removes the dedicated comment-escaping path and narrows the expansion regex to assignment-sensitive equals handling, while simultaneously broadening the generic special-character class to include #, ^, and ~. This shifts protection from ad hoc context rules toward a more conservative metacharacter escape set for Zsh. The relevant patched logic is documented in the same sources, especially 43d70b5 and PR #2649.

// Zsh before/after
const comments = new RegExp(/(^|\s)#/g);
const expansions = new RegExp(/(^|\s)([=~])/g);
const specials = new RegExp(/(["$&'()*;<>?[\]`{|}])/g);

const expansions = new RegExp(/(^|[\s:=])=/g);
const specials = new RegExp(/(["#$&'()*;<>?[\]^`{|}~])/g);

For CMD, the patch adds ( and ) to the escaped special set, and the Windows fixtures now expect caret-prefixed output such as a^(b and a^)b. Separately, src/internal/compose.js replaces a destructuring/while-loop flag protection flow with indexed fragment scanning. That refactor is not the security fix itself, but it reduces ambiguity in how leading flag fragments are skipped before escaping and is covered by updated unit assertions that now verify calls against flagResult rather than the original input.

Review

Pros

• The Dash change directly addresses the root parser-context error by recognizing that tilde expansion occurs after = and :, not only after whitespace. The new fixtures are aligned with the disclosed path disclosure scenario.
• The Zsh patch moves toward a safer default by escaping #, ^, and ~ in the generic special-character class, which is appropriate for EXTENDED_GLOB-sensitive parsing.
• The CMD fix is precise and low risk: adding parentheses to the metacharacter class closes an obvious omission and is validated by fixture updates.
• Test coverage was expanded materially across Unix and Windows fixtures, including assignment-edge cases and shell-specific metacharacters.
• The compose refactor appears to preserve intent while making fragment handling more explicit, and the unit tests were updated to assert the correct call target.

Cons

• The reviewable evidence is patch-digest level, not full source context, so some confidence depends on fixture intent rather than end-to-end shell execution traces.
• The Zsh change alters strategy from context-specific escaping to broader generic escaping. That is likely safer, but it may affect output stability for consumers expecting minimal escaping.
• The compose refactor is bundled with the security patch. Although probably benign, non-security refactors in the same change set increase review surface.
• The sources do not show explicit regression tests executing real Dash/Zsh/CMD subprocesses; the evidence presented is fixture-based expected-string validation.

Verdict

Root-cause.

The patch addresses the underlying issue class rather than only the reported payloads. In Dash, it corrects the contextual model for tilde expansion in assignment-like positions. In Zsh, it closes the metacharacter coverage gap that existed under EXTENDED_GLOB. In CMD, it adds missing grouping metacharacters to the escaped set. The fixture additions are broad enough to indicate deliberate reasoning about shell grammar, not a one-off bandaid. Based on the available sources, this is a technically sound fix for GHSA-Q53C-4PRM-W95Q, with the main residual concern being the absence of visible subprocess-backed integration tests in the provided material.