Executive brief
Shescape is a Node.js library that escapes user input to safely pass it to shell commands. On Unix systems using Zsh shell, the library fails to properly escape certain special characters, allowing attackers to leak the user's home directory path and enumerate files and directories on the system. This information disclosure could be leveraged to gain additional reconnaissance for further attacks.
Technical details
The vulnerability is an improper neutralization of wildcard and glob syntax in shell escaping (CWE-155, CWE-78). When Shescape's escape() and escapeAll() functions process user input for Zsh, they fail to neutralize tilde (~) expansion and extended glob patterns (EXTENDED_GLOB option with ^, # syntax). An attacker can craft payloads like ":~" or "pa#ckage.json" that bypass the escaping mechanism, causing Zsh to interpret them as glob patterns or home directory expansion rather than literal strings. This occurs when Shescape is explicitly configured to use Zsh or when Zsh is the system's default shell. The attack requires network reachability to the application using Shescape, but no authentication or special user interaction. Patches are available in v2.1.14 and v3.0.1.
Affected products
- Shescape Shescape <2.1.14 and 3.0.0
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: v2.1.14 and v3.0.1 released