The vulnerability in shescape arises from failure to properly escape tilde (~) characters in assignment contexts when the shell environment is explicitly configured to "sh" and /bin/sh is linked to BusyBox. This improper encoding allows an attacker to inject tilde characters via the escape and escapeAll APIs when used with untrusted input prefixed to commands. Exploitation can lead to disclosure of the user's home directory path and may influence the target location on which commands operate. The issue affects versions prior to 2.1.15 and 3.0.0 before 3.0.2. No official remediation or patch information is currently provided.

An attacker can leverage this vulnerability to disclose the user's home directory location, which may aid in further attacks or information gathering. Additionally, depending on how the injected tilde payload is used, it can alter the file system location on which commands operate, potentially leading to unintended command execution contexts or data manipulation. The CVSS 4.0 score of 9.3 indicates a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the escape and escapeAll APIs with untrusted input in assignment contexts on Unix systems configured with /bin/sh pointing to BusyBox. Monitor vendor communications for updates on patches or official mitigations.