The Shescape library has a vulnerability impacting Unix systems configured to use the Dash shell (explicitly or by default). When using the escape or escapeAll APIs in assignments prefixed to a command, an attacker can cause the shell to reveal the user's home directory by exploiting how the tilde (~) character is expanded in Dash. This disclosure can alter the command's operational context unexpectedly. The vulnerability is patched in Shescape versions v2.1.14 and v3.0.1. Users of earlier versions should upgrade accordingly. No patches are planned for versions below 2.0.0. Alternative mitigations include avoiding Dash or sanitizing inputs.

An attacker can obtain the location of the user's home directory on Unix systems running Dash shell when Shescape's escape or escapeAll APIs are used in assignment contexts. This information disclosure may lead to commands operating on unintended paths, potentially causing unexpected behavior. The vulnerability does not directly allow code execution or privilege escalation but may facilitate further attacks depending on usage context.

A fix is available in Shescape versions v2.1.14 and v3.0.1; upgrading to these versions is recommended. If using version 3, no further action is needed. For version 2 users, upgrading is advised as v2 reaches end-of-life in 2026. Workarounds include avoiding the Dash shell, using the 'env' option in node:child_process to inject untrusted variables instead of using escape APIs, or removing all '~' characters from untrusted inputs. No patches will be released for versions below 2.0.0.