Shescape home-directory disclosure in assignment context with Dash shell

Executive brief

Shescape is a library used to safely escape shell commands in Node.js applications. A vulnerability exists when using the Dash shell on Unix systems where certain inputs can bypass escaping during variable assignments. This could allow an attacker to discover the server's home directory path or potentially manipulate how commands operate, leading to unauthorized information disclosure.

Technical details

A vulnerability in Shescape's escape and escapeAll APIs (CWE-116) occurs when the library is used on Unix systems with the Dash shell. In the context of shell variable assignments (e.g., V=$payload), certain characters like ':~' are not properly neutralized, leading to tilde expansion by the shell. An attacker providing untrusted input can trigger this expansion to disclose the path of the user's home directory (CWE-200) or alter command execution logic. The issue is specific to Dash's handling of assignments and has been patched in versions 2.1.14 and 3.0.1. Workarounds include using the 'env' option in child_process instead of inline assignments or filtering tilde characters from input.

Affected products

• ericcornelissen shescape < 2.1.14, >= 3.0.0 < 3.0.1

Timeline

• 2026-07-23: disclosed
• 2026-07-24: advisory

References

• https://api.github.com/users/oran-s
• https://github.com/oran-s
• https://api.github.com/users/oran-s/gists%7B/gist_id%7D
• https://api.github.com/users/oran-s/repos
• https://avatars.githubusercontent.com/u/252446027?v=4
• https://api.github.com/users/oran-s/events%7B/privacy%7D