CVE-2026-27613: Pascal Cgi Shell Escape Double Quote In Caret Set

A constant set of "dangerous" Windows shell metacharacters used for caret-prefix escaping ('^X') contains the double-quote character ('"'). Caret escaping is only honored by cmd.exe. Native Win32 binaries (e.g. php-cgi.exe and any CGI interpreter built with the MSVCRT runtime) parse their command line via CommandLineToArgvW, which only recognises '\"' as an

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Generic
greprules fetch cve-2026-27613-pascal-cgi-shell-escape-double-quote-in-caret-set --engine opengrep

Description

A constant set of "dangerous" Windows shell metacharacters used for caret-prefix escaping ('^X') contains the double-quote character ('"'). Caret escaping is only honored by cmd.exe. Native Win32 binaries (e.g. php-cgi.exe and any CGI interpreter built with the MSVCRT runtime) parse their command line via CommandLineToArgvW, which only recognises '\"' as an