{"items":[{"id":"NVI-00015065","kind":"vulnerability","title":"Shescape: Home-directory disclosure in assignment context on Unix with Dash","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-q53c-4prm-w95q","CVE-2026-73411"],"plain_summary":"GitHub lists this reviewed advisory for shescape, shescape. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6ae33f0450d5c3e72d98e493c62df4b2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-24T15:10:00.190Z","value":"6.3 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-6ae33f0450d5c3e72d98e493c62df4b2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-15135dfedbd6d36ab0976c701d20711f","url":"https://github.com/advisories/GHSA-q53c-4prm-w95q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-q53c-4prm-w95q","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:17:12.848Z"},{"id":"sr-6ae33f0450d5c3e72d98e493c62df4b2","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73411","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-73411","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T19:45:24.870Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-15135dfedbd6d36ab0976c701d20711f"],"technology":"shescape","known_exclusions":[],"conditions_summary":"### Impact\n\nThis impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the default shell is Dash, using the `escape` and `escapeAll` APIs in assignments prefixed to a command.\n\nAn attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways.\n\n```javascript\nimport * as cp from \"node:child_process\";\nimport { Shescape } from \"shescape\";\n\n// 1. Prerequisites\nconst options = {\n    shell: \"dash\",\n    // Or\n    shell: true, // Only if the default shell is Dash\n};\n\n// 2. Payload\nconst payload = \":~\";\n\n// 3. Usage\nconst shescape = new Shescape(options);\nlet escapedPayload;\n\nescapedPayload = shescape.escape(payload);\n// Or\nescapedPayload = shescape.escapeAll([payload]);\n\n// And (example)\nconst result = cp.execSync(`V=${escapedPayload}; echo $V`, options);\n\n// 4. Impact\nconsole.log(result.toString());\n// Outputs \":\" followed by the user's home directory\n```\n\n### Patches\n\nThis bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now.\n\nIf you are already using v3 of Shescape, no further changes are required. If you are using v","public_affected_ranges":["< 2.1.14"]},{"certainty":"source_listed","source_ids":["sr-15135dfedbd6d36ab0976c701d20711f"],"technology":"shescape","known_exclusions":[],"conditions_summary":"### Impact\n\nThis impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the default shell is Dash, using the `escape` and `escapeAll` APIs in assignments prefixed to a command.\n\nAn attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways.\n\n```javascript\nimport * as cp from \"node:child_process\";\nimport { Shescape } from \"shescape\";\n\n// 1. Prerequisites\nconst options = {\n    shell: \"dash\",\n    // Or\n    shell: true, // Only if the default shell is Dash\n};\n\n// 2. Payload\nconst payload = \":~\";\n\n// 3. Usage\nconst shescape = new Shescape(options);\nlet escapedPayload;\n\nescapedPayload = shescape.escape(payload);\n// Or\nescapedPayload = shescape.escapeAll([payload]);\n\n// And (example)\nconst result = cp.execSync(`V=${escapedPayload}; echo $V`, options);\n\n// 4. Impact\nconsole.log(result.toString());\n// Outputs \":\" followed by the user's home directory\n```\n\n### Patches\n\nThis bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now.\n\nIf you are already using v3 of Shescape, no further changes are required. If you are using v","public_affected_ranges":[">= 3.0.0, < 3.0.1"]}],"null_published_at":"2026-11-08T19:53:44.066Z","source_updated_at":"2026-08-12T19:33:13.000Z","source_disclosed_at":"2026-07-24T22:34:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T20:17:12.848Z"},{"id":"NVI-00015065","kind":"vulnerability","title":"Shescape: Home-directory disclosure in assignment context on Unix with Dash","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-q53c-4prm-w95q","CVE-2026-73411"],"plain_summary":"GitHub lists this reviewed advisory for shescape, shescape. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-15135dfedbd6d36ab0976c701d20711f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-15135dfedbd6d36ab0976c701d20711f","url":"https://github.com/advisories/GHSA-q53c-4prm-w95q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-q53c-4prm-w95q","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:17:12.848Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-15135dfedbd6d36ab0976c701d20711f"],"technology":"shescape","known_exclusions":[],"conditions_summary":"### Impact\n\nThis impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the default shell is Dash, using the `escape` and `escapeAll` APIs in assignments prefixed to a command.\n\nAn attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways.\n\n```javascript\nimport * as cp from \"node:child_process\";\nimport { Shescape } from \"shescape\";\n\n// 1. Prerequisites\nconst options = {\n    shell: \"dash\",\n    // Or\n    shell: true, // Only if the default shell is Dash\n};\n\n// 2. Payload\nconst payload = \":~\";\n\n// 3. Usage\nconst shescape = new Shescape(options);\nlet escapedPayload;\n\nescapedPayload = shescape.escape(payload);\n// Or\nescapedPayload = shescape.escapeAll([payload]);\n\n// And (example)\nconst result = cp.execSync(`V=${escapedPayload}; echo $V`, options);\n\n// 4. Impact\nconsole.log(result.toString());\n// Outputs \":\" followed by the user's home directory\n```\n\n### Patches\n\nThis bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now.\n\nIf you are already using v3 of Shescape, no further changes are required. If you are using v","public_affected_ranges":["< 2.1.14"]},{"certainty":"source_listed","source_ids":["sr-15135dfedbd6d36ab0976c701d20711f"],"technology":"shescape","known_exclusions":[],"conditions_summary":"### Impact\n\nThis impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the default shell is Dash, using the `escape` and `escapeAll` APIs in assignments prefixed to a command.\n\nAn attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways.\n\n```javascript\nimport * as cp from \"node:child_process\";\nimport { Shescape } from \"shescape\";\n\n// 1. Prerequisites\nconst options = {\n    shell: \"dash\",\n    // Or\n    shell: true, // Only if the default shell is Dash\n};\n\n// 2. Payload\nconst payload = \":~\";\n\n// 3. Usage\nconst shescape = new Shescape(options);\nlet escapedPayload;\n\nescapedPayload = shescape.escape(payload);\n// Or\nescapedPayload = shescape.escapeAll([payload]);\n\n// And (example)\nconst result = cp.execSync(`V=${escapedPayload}; echo $V`, options);\n\n// 4. Impact\nconsole.log(result.toString());\n// Outputs \":\" followed by the user's home directory\n```\n\n### Patches\n\nThis bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now.\n\nIf you are already using v3 of Shescape, no further changes are required. If you are using v","public_affected_ranges":[">= 3.0.0, < 3.0.1"]}],"null_published_at":"2026-11-03T10:03:26.541Z","source_updated_at":"2026-08-12T19:33:13.000Z","source_disclosed_at":"2026-07-24T22:34:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:17:12.848Z"}],"next_cursor":null,"snapshot_revision":"42594"}