Threats Tagged 'ghsa-q53c-4prm-w95q'

A vulnerability in the Shescape library on Unix systems using the Dash shell allows an attacker to disclose the user's home directory when using the escape or escapeAll APIs in assignment contexts prefixed to a command. This can lead to unexpected command behavior if the disclosed home directory is used maliciously. The issue affects versions of Shescape prior to v2.1.14 and versions from 3.0.0 up to but not including 3.0.1. Patches are available in v2.1.14 and v3.0.1. Workarounds include avoiding Dash, using environment variables for untrusted inputs, or removing '~' from untrusted inputs.