The vulnerability in shescape occurs in the getEscapeFunction within src/internal/unix/dash.js, where the tilde (~) character is not properly escaped after ':' or '=' when using the escape or escapeAll APIs on Unix systems with the shell set to dash or when shell is true and dash is the default. This improper escaping can lead to information disclosure of the home directory path and potentially change the command execution context. Versions prior to 2.1.14 and 3.0.1 are affected. The flaw is classified under CWE-116 (Improper Encoding or Escaping of Output) and CWE-200 (Information Exposure).

An attacker who can control the input to the vulnerable APIs may supply crafted values such as ':~' to disclose the home directory path, which is sensitive information. Additionally, the attacker may influence the location on which a shell command operates, potentially leading to unintended command behavior or information exposure. There is no indication of privilege escalation or remote code execution from the provided data.

The vulnerability is fixed in shescape versions 2.1.14 and 3.0.1. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated in the available data. Patch status is not explicitly confirmed in the vendor advisory, but the description clearly states the fix versions.