The vulnerability in shescape occurs because versions prior to 2.1.15 and 3.0.2 do not properly escape tilde (~) characters in assignment contexts when the shell environment is configured as "sh" and /bin/sh is linked to BusyBox. When untrusted input is passed to the escape or escapeAll APIs in an assignment prefix to a command, an attacker can inject a tilde character that causes disclosure of the user's home directory path and may influence the command's operational context. This improper encoding or escaping flaw can lead to information disclosure and command behavior alteration under specific shell configurations.

An attacker can use this vulnerability to disclose the user's home directory path and potentially alter the location on which a command operates. This could lead to unintended command execution contexts or information leakage about the environment. The impact is limited to environments where the shell is explicitly set to "sh" and /bin/sh points to BusyBox, and where untrusted input is passed to the affected APIs in assignment contexts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to versions 2.1.15 or later, or 3.0.2 or later, where this issue is fixed. Until then, avoid passing untrusted input to the escape and escapeAll APIs in assignment contexts on affected shell configurations.