Skip to main content
VulnerabilityPublished 07/24/2026

Shescape: Path disclosure on Unix with Zsh

Affects shescapeSource GCVE Database

Severity
Medium

Rated by Threat Radar

Patch
Available – fixed in 2.1.14, 3.0.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What to do

AI-suggested

A fix is available in Shescape versions 2.1.14 and 3.0.1. Users should upgrade to these versions or later. For users on version 3, no further changes are required beyond upgrading. For users on version 2, upgrading is recommended as version 2 will reach end-of-life on 2026-09-28. No patches will be released for versions below 2.0.0. Alternatively, users can mitigate by not using Zsh, disabling the EXTENDED_GLOB option in Zsh, or sanitizing untrusted inputs to remove the characters ^, #, and ~.

Affected software

ProductAffectedFixed in
npmshescapeAffected
  • <2.1.14
Fixed in
  • 2.1.14
npmshescapeAffected
  • >=3.0.0 <3.0.1
Fixed in
  • 3.0.1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Shescape versions prior to 2.1.14 and versions 3.0.0 up to but excluding 3.0.1 on Unix systems configured to use Zsh shell are vulnerable to path disclosure. The vulnerability arises when using the escape or escapeAll functions with Zsh-specific features like EXTENDED_GLOB and MAGIC_EQUAL_SUBST, allowing attackers to leverage home directory expansion and extended glob syntax to list files and directories. This can lead to unintended information disclosure about the filesystem. The issue has been patched in versions 2.1.14 and 3.0.1. Users are advised to upgrade or apply workarounds such as disabling EXTENDED_GLOB or sanitizing inputs.

Weaknesses

References