https://vulnerability.circl.lu/sightings/feed 2026-07-25T20:18:27.082411+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6ba9bc80-41d1-475f-8a7c-4dd5825f3a85/export 2026-07-25T20:18:27.090430+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6ba9bc80-41d1-475f-8a7c-4dd5825f3a85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6V4M-FW66-8R4X", "type": "seen", "source": "https://gist.github.com/alon710/4f741e2f37db8bd62ab69cf05173516c", "content": "# GHSA-6V4M-FW66-8R4X: GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-6V4M-FW66-8R4X\n\n## Summary\nAn incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.\n\n## TL;DR\nShescape failed to escape critical shell control characters when placed immediately after punctuation, leading to path disclosure in Unix shells and syntax breakout in Windows cmd.exe.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200 / CWE-20\n- **Attack Vector**: Local / Network\n- **CVSS v3.1 Score**: 6.5\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n- **Impact**: Absolute Path Disclosure / Command Execution Bypass\n\n## Affected Systems\n\n- Applications running on Node.js using shescape < 2.1.14 or shescape == 3.0.0 on Unix shells (Zsh, Dash, POSIX) or Windows cmd.exe\n- **shescape**: < 2.1.14 (Fixed in: `2.1.14`)\n- **shescape**: == 3.0.0 (Fixed in: `3.0.1`)\n\n## Mitigation\n\n- Upgrade the shescape package to version 2.1.14 (for 2.x installations) or 3.0.1 (for 3.x installations).\n- Avoid executing system commands inside shell interpreters; utilize argument arrays with direct execution APIs like execFile.\n- Implement a strict input validation filter (whitelist) to block shell control characters before passing arguments to shescape.\n\n**Remediation Steps:**\n1. Identify all projects containing shescape in package-lock.json or yarn.lock.\n2. Update dependencies by running 'npm install shescape@latest' or 'yarn upgrade shescape'.\n3. Verify the installed version is >= 2.1.14 or >= 3.0.1.\n4. Audit command execution paths to confirm shell integration is necessary, transitioning to shell-less execution wrappers where possible.\n\n## References\n\n- [GHSA-6V4M-FW66-8R4X Advisory Details](https://github.com/advisories/GHSA-6V4M-FW66-8R4X)\n- [Shescape Release v2.1.14](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14)\n- [Shescape Release v3.0.1](https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-6V4M-FW66-8R4X) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T13:48:43.222677Z"} 2026-07-25T13:48:43.222677+00:00