DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-6V4M-FW66-8R4X: GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape

#security #cve #cybersecurity #ghsa

GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape

Vulnerability ID: GHSA-6V4M-FW66-8R4X
CVSS Score: 6.5
Published: 2026-07-24

An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.

TL;DR

Shescape failed to escape critical shell control characters when placed immediately after punctuation, leading to path disclosure in Unix shells and syntax breakout in Windows cmd.exe.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200 / CWE-20
  • Attack Vector: Local / Network
  • CVSS v3.1 Score: 6.5
  • Exploit Status: poc
  • CISA KEV Status: Not Listed
  • Impact: Absolute Path Disclosure / Command Execution Bypass

Affected Systems

  • Applications running on Node.js using shescape < 2.1.14 or shescape == 3.0.0 on Unix shells (Zsh, Dash, POSIX) or Windows cmd.exe
  • shescape: < 2.1.14 (Fixed in: 2.1.14)
  • shescape: == 3.0.0 (Fixed in: 3.0.1)

Code Analysis

Commit: 43d70b5

fix: escape tilde and hash unconditionally on zsh, fix compose flag loop

Commit: b4b34c3

fix: backport escaping and compose loop fixes to v2 line

Mitigation Strategies

  • Upgrade the shescape package to version 2.1.14 (for 2.x installations) or 3.0.1 (for 3.x installations).
  • Avoid executing system commands inside shell interpreters; utilize argument arrays with direct execution APIs like execFile.
  • Implement a strict input validation filter (whitelist) to block shell control characters before passing arguments to shescape.

Remediation Steps:

  1. Identify all projects containing shescape in package-lock.json or yarn.lock.
  2. Update dependencies by running 'npm install shescape@latest' or 'yarn upgrade shescape'.
  3. Verify the installed version is >= 2.1.14 or >= 3.0.1.
  4. Audit command execution paths to confirm shell integration is necessary, transitioning to shell-less execution wrappers where possible.

References

Read the full report for GHSA-6V4M-FW66-8R4X on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)