{"vulnerability": "GHSA-Q53C-4PRM-W95Q", "sightings": [{"uuid": "83a5f0a6-137c-4bde-affa-da11dea00d48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-Q53C-4PRM-W95Q", "type": "seen", "source": "https://gist.github.com/alon710/7d82b3a29a466133e3b991f0cb56fd86", "content": "# GHSA-Q53C-4PRM-W95Q: GHSA-q53c-4prm-w95q: Unix Home Directory Path Disclosure and Command Escaping Flaws in Shescape\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-Q53C-4PRM-W95Q\n\n## Summary\nAn escaping bypass in the npm package shescape on Unix platforms utilizing the Dash shell can result in unauthorized home directory path disclosure. The vulnerability occurs when user input containing specific sequences is passed inside shell variable assignment contexts. Additionally, the patch addresses secondary security gaps related to Zsh extended globbing and Windows CMD command block breakouts.\n\n## TL;DR\nA path disclosure flaw in shescape allows unescaped tilde expansions in Dash shell variable assignments, leaking user home directories. Secondary fixes address Zsh and Windows CMD injection points.\n\n## Technical Details\n\n- **CWE ID**: CWE-116, CWE-200\n- **Attack Vector**: Network\n- **CVSS v4 Score**: 6.3 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Information Disclosure / Arbitrary Command Execution\n\n## Affected Systems\n\n- npm package shescape on Unix platforms utilizing Dash shell\n- npm package shescape on Unix platforms utilizing Zsh with EXTENDED_GLOB\n- npm package shescape on Windows platforms utilizing CMD\n- **shescape**: < 2.1.14 (Fixed in: `2.1.14`)\n- **shescape**: >= 3.0.0, < 3.0.1 (Fixed in: `3.0.1`)\n\n## Mitigation\n\n- Upgrade shescape to version 2.1.14 or 3.0.1\n- Utilize isolated process environment variable passing instead of command-line string interpolation\n- Avoid utilizing vulnerable shell configurations such as Dash or unpatched CMD inside execution APIs\n\n**Remediation Steps:**\n1. Run 'npm install shescape@latest' or specify >=3.0.1 (or >=2.1.14 for v2) in package.json dependencies\n2. Audit existing codebase for occurrences of 'shescape.escape' inside shell assignments\n3. Migrate child execution APIs from exec and execSync to execFile or spawn where parameterization is enforced\n\n## References\n\n- [GitHub Security Advisory GHSA-Q53C-4PRM-W95Q](https://github.com/advisories/GHSA-Q53C-4PRM-W95Q)\n- [Shescape Repository Advisory](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-q53c-4prm-w95q)\n- [v3 Remediation Commit](https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de)\n- [v2 Remediation Commit (Backport)](https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f)\n- [v3 Remediation Pull Request](https://github.com/ericcornelissen/shescape/pull/2649)\n- [v2 Remediation Pull Request](https://github.com/ericcornelissen/shescape/pull/2651)\n- [v2.1.14 Release Notes](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14)\n- [v3.0.1 Release Notes](https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1)\n- [Shescape Migration Documentation](https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-Q53C-4PRM-W95Q) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T11:31:34.212376Z"}]}