Threats tagged 'ghsa-jfpg-hfv5-2rf7'

CVE-2026-73055 is a medium severity vulnerability in the ericcornelissen shescape library affecting versions before 2.1.15 and 3.0.0 before 3.0.2. The issue involves improper escaping of tilde (~) characters in assignment contexts on Unix systems where the shell is set to "sh" and /bin/sh points to BusyBox. This can allow an attacker using the escape and escapeAll APIs with untrusted input to inject a tilde payload that discloses the user's home directory location and potentially alters the target location of a command.