Description

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-15T22:16:55.427Z",
  "pubdate": "2026-08-15T22:16:55.427Z",
  "executiveSummary": "Shescape before versions 2.1.15 and 3.0.2 contain a tilde character improper neutralization vulnerability affecting Unix-based systems. This flaw allows an attacker capable of supplying untrusted input to assignment contexts prefixed to a command to inject arbitrary tilde payloads under specific shell configurations.\nThe vulnerability occurs when the target shell is explicitly configured to 'sh' or true, and the /bin/sh system interpreter points to BusyBox. Successful exploitation compromises the confidentiality and integrity of file system operations managed by the application.\nDepending on how the underlying command uses the supplied data, an attacker can disclose the local user's home directory location or manipulate the target path on which a command executes. The attack requires the processing of maliciously crafted untrusted input through the vulnerable APIs without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the escape and escapeAll APIs provided by Shescape, which fail to properly sanitize and escape tilde (~) characters when used in assignment contexts on Unix systems. The root cause is insufficient input sanitization logic for specific shell dialects and command wrappers, specifically when processing assignments prefixed to commands under BusyBox implementations of /bin/sh.\nWhen an application utilizes the vulnerable escape or escapeAll functions to process untrusted user-supplied input intended for a command assignment, the lack of appropriate tilde neutralization permits shell expansion mechanisms to interpret the input character as a home directory expansion directive.\nThe step-by-step attack flow proceeds as follows: First, an attacker supplies malicious input containing unescaped tilde payloads via an untrusted entry vector. Second, the application passes this input to the vulnerable escape or escapeAll APIs. Third, because the sanitization routine fails to neutralize the tilde character, the resulting escaped string retains the injection vector when integrated into a command assignment context. Fourth, the operating system executes the resulting command using an affected shell environment where /bin/sh points to BusyBox and the shell is configured to 'sh' or true. Finally, the shell processes the tilde expansion, leading to unauthorized home directory disclosure or path redirection depending on the intended command logic.\nAffected versions include Shescape prior to version 2.1.15 and version 3.0.0 prior to version 3.0.2. The vulnerable components are the escape and escapeAll APIs. The exploitation vector is local or remote depending on the application architecture, requiring untrusted input injection into command assignment contexts without authentication or privilege requirements."
}