# CVE-2022-24725: shescape home directory exposure in Bash with interpolation

Source: https://junglewise.ai/threats/cve-2022-24725-shescape-home-directory-exposure-in-bash-with-interpolation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-24725 · Severity: low · CVSS 3.1 · Published 2022-03-03

shescape is a shell-escaping library for JavaScript used to safely pass untrusted data to shell commands. When the interpolation option is enabled on Unix systems running Bash, the library fails to properly escape the tilde character (~), allowing it to be expanded to the user's home directory path. An attacker who controls input strings containing "=~" or similar patterns can leak the home directory path or potentially achieve directory traversal if the output is used in file operations.

Technologies: [shescape (npm)](https://junglewise.ai/threats/technologies/shescape). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-24725 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-24725 being exploited in the wild.

**How severe is CVE-2022-24725?** Low severity, with a CVSS score of 3.1, published 3 March 2022.

**Which products and versions are affected?** shescape (npm) SEMVER:introduced=1.4.0,fixed=1.5.1.

**Is there a fix for CVE-2022-24725?** Yes. shescape (npm): upgrade to 1.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-24725 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2022-24725?** Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shescape (npm): upgrade to 1.5.1 or later

  ```sh
  npm install shescape@1.5.1
  ```


## Technical details

shescape's escape() and escapeAll() functions fail to properly escape tilde characters in Bash when the interpolation option is enabled. Bash treats tilde expansion specially: a tilde at the end of an argument (e.g., "=~") or in patterns like "xxx:~", "~:xxx", or "xxx:~:xxx" following an equals sign will expand to the user's home directory path. The vulnerability occurs because shescape does not escape tildes in these contexts when interpolation is active, allowing an attacker-controlled string containing these patterns to leak the home directory pathname. While Dash and Zsh shells are not affected, applications using shescape with Bash on Unix systems are vulnerable. The issue was fixed in version 1.5.1. Applications using vulnerable versions with untrusted input in shell commands can mitigate by manually escaping tildes using `arg.replace(/~/g, "\\~")`.

## Affected products

- ericcornelissen shescape >=1.4.0, <1.5.1

## Identifiers

- CVE-2022-24725
- GHSA-446w-rrm4-r47f

## Timeline

- 2022-03-03: disclosed
- 2022-03-03: patched: Fixed in version 1.5.1

## References

- [https://github.com/ericcornelissen/shescape/security/advisories/GHSA-446w-rrm4-r47f](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-446w-rrm4-r47f)
- [https://github.com/ericcornelissen/shescape/issues/169](https://github.com/ericcornelissen/shescape/issues/169)
- [https://github.com/ericcornelissen/shescape/pull/170](https://github.com/ericcornelissen/shescape/pull/170)
- [https://github.com/ericcornelissen/shescape](https://github.com/ericcornelissen/shescape)

## Related threats

- [Shescape shell injection via unescaped parentheses on Windows CMD](https://junglewise.ai/threats/cve-2026-73414-shescape-shell-injection-via-unescaped-parentheses-on-windows-cmd)
- [Shescape quadratic-time denial of service in flag-protection](https://junglewise.ai/threats/cve-2026-73413-shescape-quadratic-time-denial-of-service-in-flag-protection)
- [Shescape path disclosure on Unix with Zsh](https://junglewise.ai/threats/cve-2026-73412-shescape-path-disclosure-on-unix-with-zsh)
- [Shescape home-directory disclosure in Dash shell assignment](https://junglewise.ai/threats/cve-2026-73411-shescape-home-directory-disclosure-in-dash-shell-assignment)
- [Shescape escape() bracket glob expansion bypass on Bash, BusyBox, and Dash](https://junglewise.ai/threats/cve-2026-32094-shescape-escape-bracket-glob-expansion-bypass-on-bash-busybox-and)