GHSA-q53c-4prm-w95q: Unix Home Directory Path Disclosure and Command Escaping Flaws in Shescape
Vulnerability ID: GHSA-Q53C-4PRM-W95Q
CVSS Score: 6.3
Published: 2026-07-24
An escaping bypass in the npm package shescape on Unix platforms utilizing the Dash shell can result in unauthorized home directory path disclosure. The vulnerability occurs when user input containing specific sequences is passed inside shell variable assignment contexts. Additionally, the patch addresses secondary security gaps related to Zsh extended globbing and Windows CMD command block breakouts.
TL;DR
A path disclosure flaw in shescape allows unescaped tilde expansions in Dash shell variable assignments, leaking user home directories. Secondary fixes address Zsh and Windows CMD injection points.
Technical Details
- CWE ID: CWE-116, CWE-200
- Attack Vector: Network
- CVSS v4 Score: 6.3 (Medium)
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
- Impact: Information Disclosure / Arbitrary Command Execution
Affected Systems
- npm package shescape on Unix platforms utilizing Dash shell
- npm package shescape on Unix platforms utilizing Zsh with EXTENDED_GLOB
- npm package shescape on Windows platforms utilizing CMD
-
shescape: < 2.1.14 (Fixed in:
2.1.14) -
shescape: >= 3.0.0, < 3.0.1 (Fixed in:
3.0.1)
Code Analysis
Commit: 43d70b5
Fix escaping for Dash, Zsh, and CMD on v3
Commit: b4b34c3
Backport escaping fixes to v2
Exploit Details
- GitHub Security Advisory: Official advisory proof-of-concept showing home directory disclosure in Dash
Mitigation Strategies
- Upgrade shescape to version 2.1.14 or 3.0.1
- Utilize isolated process environment variable passing instead of command-line string interpolation
- Avoid utilizing vulnerable shell configurations such as Dash or unpatched CMD inside execution APIs
Remediation Steps:
- Run 'npm install shescape@latest' or specify >=3.0.1 (or >=2.1.14 for v2) in package.json dependencies
- Audit existing codebase for occurrences of 'shescape.escape' inside shell assignments
- Migrate child execution APIs from exec and execSync to execFile or spawn where parameterization is enforced
References
- GitHub Security Advisory GHSA-Q53C-4PRM-W95Q
- Shescape Repository Advisory
- v3 Remediation Commit
- v2 Remediation Commit (Backport)
- v3 Remediation Pull Request
- v2 Remediation Pull Request
- v2.1.14 Release Notes
- v3.0.1 Release Notes
- Shescape Migration Documentation
Read the full report for GHSA-Q53C-4PRM-W95Q on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)