Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-X6P3-76F2-XXVH

    Vulnerability from github – Published: 2026-05-28 20:02 – Updated: 2026-05-28 20:02
    VLAI
    Summary
    Shamefile has an arbitrary file read via shamefile.yaml in shame next
    Details

    Impact

    A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.

    Patches

    Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.

    Workarounds

    Do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.

    Resources

    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.6"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "shamefile"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "shamefile"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.6"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "shamefile"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47144"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-28T20:02:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.\n\n### Patches\n\nFixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.\n\n### Workarounds\n\nDo not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.\n\n### Resources\n\n- Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557\n- Pull request: https://github.com/BKDDFS/shamefile/pull/80\n- Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7\n- [CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)](https://cwe.mitre.org/data/definitions/22.html)",
  "id": "GHSA-x6p3-76f2-xxvh",
  "modified": "2026-05-28T20:02:14Z",
  "published": "2026-05-28T20:02:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/security/advisories/GHSA-x6p3-76f2-xxvh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/pull/80"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BKDDFS/shamefile"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shamefile has an arbitrary file read via shamefile.yaml in shame next"
}

    PYSEC-2026-3065

    Vulnerability from pysec - Published: 2026-07-13 15:19 - Updated: 2026-07-13 16:06
    VLAI
    Details

    Impact

    A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.

    Patches

    Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.

    Workarounds

    Do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.

    Resources

    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    Impacted products
    Name purl
    shamefile pkg:pypi/shamefile
    Aliases
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "shamefile",
        "purl": "pkg:pypi/shamefile"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.0rc2",
        "0.1.0rc3",
        "0.1.1",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47144",
    "GHSA-x6p3-76f2-xxvh"
  ],
  "details": "### Impact\n\nA path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.\n\n### Patches\n\nFixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.\n\n### Workarounds\n\nDo not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.\n\n### Resources\n\n- Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557\n- Pull request: https://github.com/BKDDFS/shamefile/pull/80\n- Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7\n- [CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)](https://cwe.mitre.org/data/definitions/22.html)",
  "id": "PYSEC-2026-3065",
  "modified": "2026-07-13T16:06:17.918839Z",
  "published": "2026-07-13T15:19:13.415409Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/security/advisories/GHSA-x6p3-76f2-xxvh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/pull/80"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BKDDFS/shamefile"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/shamefile"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-x6p3-76f2-xxvh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47144"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shamefile has an arbitrary file read via shamefile.yaml in shame next"
}