Shescape CVE-2026-73055
CRITICALSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Untrusted input may arrive over the network (AV:N) but exploitation needs a non-default BusyBox sh assignment context (AC:H); impact is home-directory disclosure (C:L) and possible command-target change (I:L), no availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.
AnalysisAI
Information disclosure in Shescape, a Node.js shell-argument escaping library, affects versions before 2.1.15 and the 3.0.x line before 3.0.2 when the library's escape/escapeAll output is placed in a shell variable assignment and the runtime shell is explicitly set to "sh" (or true) with /bin/sh symlinked to BusyBox. Under those conditions an attacker who controls the escaped input can inject an unescaped tilde (~) that BusyBox expands, revealing the user's home directory path and, depending on how the assignment feeds the command, redirecting the filesystem location a command targets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following concrete prerequisites drawn from the description: the target uses Shescape's escape or escapeAll API on attacker-controlled input; that output is placed as a variable-assignment prefix to a command (VAR=value command form); the runtime shell is explicitly configured to "sh" or true; and the host's /bin/sh symlink points to BusyBox on a Unix system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) substantially overstates real-world impact and conflicts with the description, which characterizes the issue as disclosure of the home directory location and possible alteration of a command's target location - an information-disclosure/limited-integrity problem, not full confidentiality, integrity, and availability compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application running on a BusyBox-based container (a very common Alpine/embedded setup) uses Shescape's escapeAll to build a command like ENVVAR=<user-supplied-path> some-tool, with the shell set to sh. An attacker submits a value beginning with ~ that survives escaping and is expanded by BusyBox to the process owner's home directory, leaking that path back to the attacker or causing the tool to operate on a different filesystem location than intended. … |
| Remediation | Upgrade Shescape to a fixed release: 2.1.15 for the 2.x line or 3.0.2 for the 3.x line (Vendor-released patch: 2.1.15 and 3.0.2), which include the corrected tilde escaping from PR #2678 (commits 7cba30594c16a21524706efe2f6c6c9d8923f411 and d86bf2ae22961c73458bddf70dd06adf9dadb36c); consult GHSA-j44h-fqhh-fh28 for guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Node.js applications to identify those using Shescape versions prior to 2.1.15 (2.x line) or 3.0.2 (3.x line) by reviewing package-lock.json and dependency manifests; prioritize systems running containerized workloads or embedded Linux environments using BusyBox. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today