The Shescape library on Unix systems configured with Zsh shell is vulnerable to path disclosure when using the escape or escapeAll functions. This vulnerability is exacerbated by Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST, which allow attackers to exploit home directory expansion and extended glob syntax to obtain lists of files and directories. The vulnerability affects versions prior to 2.1.14 and versions from 3.0.0 up to but excluding 3.0.1. The issue has been addressed with patches in versions 2.1.14 and 3.0.1. Workarounds include avoiding Zsh, disabling EXTENDED_GLOB, or sanitizing untrusted inputs to remove special characters like ^, #, and ~.

An attacker can leverage this vulnerability to disclose filesystem paths and lists of files and directories on affected Unix systems using Zsh with Shescape. This information disclosure could potentially aid further attacks or reconnaissance but does not directly allow code execution or privilege escalation based on the provided data.

A fix is available in Shescape versions 2.1.14 and 3.0.1. Users should upgrade to these versions or later. For users on version 3, no further changes are required beyond upgrading. For users on version 2, upgrading is recommended as version 2 will reach end-of-life on 2026-09-28. No patches will be released for versions below 2.0.0. Alternatively, users can mitigate by not using Zsh, disabling the EXTENDED_GLOB option in Zsh, or sanitizing untrusted inputs to remove the characters ^, #, and ~.