OSEC-2026-24

Multiple issues in command quoting on Windows

ANT-2026-R7FKP7RG Win32 quote_cmd_filename misses pipe/redirect metacharacters ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe_quote/make_cmdline ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped Also includes the fix for [OSEC-2026-05](https://osv.dev/vulnerability/OSEC-2026-05) `Filename.quote_command` returns a quoted command line, suitable for use as an argument to `Sys.command`, `Unix.system`, and the `Unix.open_process` functions. However on Windows certain characters weren't properly escaped. `Unix.create_process` can invoke `.bat` or `.cmd` programs on Windows, and certain characters were accepted that cannot be quoted safely. ## Fix `Filename.quote_command` has been updated to correctly quote arguments. `Unix.create_process*` has been updated to reject arguments that cannot be safely quoted by raising `Failure`: > if the program [prog] is a [.bat] or [.cmd] > script and either [prog] or [args] contain characters that cannot be > securely passed to a script, such as [" | & , ; < = > ^ % "]. > If you really need to pass these characters to a script, consider > using {!Unix.system} instead. ## Am I affected? If you use `Filename.quote_command` on Windows with user supplied arguments. If you use `Unix.create_process*` or `Unix.open_process*` on Windows with `.bat` or `.cmd` programs, and user supplied arguments. ## Timeline - 2026-08-24: vulnerability was found - 2026-08-27: forwarded report to security@ocaml.org - 2029-09-05: fix merged to trunk