Shescape: Home-directory disclosure in assignment context on Unix with Dash
Affects shescapeSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 2.1.14, 3.0.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmshescape | Affected
| Fixed in
|
| npmshescape | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in Shescape versions v2.1.14 and v3.0.1; upgrading to these versions is recommended. If using version 3, no further action is needed. For version 2 users, upgrading is advised as v2 reaches end-of-life in 2026. Workarounds include avoiding the Dash shell, using the 'env' option in node:child_process to inject untrusted variables instead of using escape APIs, or removing all '~' characters from untrusted inputs. No patches will be released for versions below 2.0.0.
Description
A vulnerability in the Shescape library on Unix systems using the Dash shell allows an attacker to disclose the user's home directory when using the escape or escapeAll APIs in assignment contexts prefixed to a command. This can lead to unexpected command behavior if the disclosed home directory is used maliciously. The issue affects versions of Shescape prior to v2.1.14 and versions from 3.0.0 up to but not including 3.0.1. Patches are available in v2.1.14 and v3.0.1. Workarounds include avoiding Dash, using environment variables for untrusted inputs, or removing '~' from untrusted inputs.
Impact
An attacker can obtain the location of the user's home directory on Unix systems running Dash shell when Shescape's escape or escapeAll APIs are used in assignment contexts. This information disclosure may lead to commands operating on unintended paths, potentially causing unexpected behavior. The vulnerability does not directly allow code execution or privilege escalation but may facilitate further attacks depending on usage context.
Summary
The Shescape library has a vulnerability impacting Unix systems configured to use the Dash shell (explicitly or by default). When using the escape or escapeAll APIs in assignments prefixed to a command, an attacker can cause the shell to reveal the user's home directory by exploiting how the tilde (~) character is expanded in Dash. This disclosure can alter the command's operational context unexpectedly. The vulnerability is patched in Shescape versions v2.1.14 and v3.0.1. Users of earlier versions should upgrade accordingly. No patches are planned for versions below 2.0.0. Alternative mitigations include avoiding Dash or sanitizing inputs.
Weaknesses
References
- github.com/ericcornelissen/shescape/security/advisories/GHSA-q53c-4prm-w95q (opens in a new tab)
- github.com/ericcornelissen/shescape/pull/2649 (opens in a new tab)
- github.com/ericcornelissen/shescape/pull/2651 (opens in a new tab)
- github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de (opens in a new tab)
- github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f (opens in a new tab)
- github.com/ericcornelissen/shescape (opens in a new tab)
- github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md (opens in a new tab)
- github.com/ericcornelissen/shescape/releases/tag/v2.1.14 (opens in a new tab)
- github.com/ericcornelissen/shescape/releases/tag/v3.0.1 (opens in a new tab)