CVE-2026-73055

Received Received - Intake

Command Injection in Shescape via Tilde Expansion

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73055

Affected Vendors & Products

Vendor	Product	Version / Range
shescape	shescape	to 2.1.15 (exc)
shescape	shescape	From 3.0.0 (exc) to 3.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

Shescape before version 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is set to 'sh' or true and /bin/sh points to BusyBox. This allows attackers to inject tilde payloads through untrusted input in assignments prefixed to commands.

Detection Guidance

To detect this vulnerability, check if shescape versions before 2.1.15 or 3.0.0 before 3.0.2 are installed on Unix systems where /bin/sh points to BusyBox. Run commands like 'npm list shescape' or 'find / -name shescape 2>/dev/null' to locate the package.

Impact Analysis

An attacker could disclose the user's home directory location and potentially alter the directory where a command operates. This could lead to unauthorized access, data leakage, or manipulation of system operations depending on how the vulnerable API is used.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to a user's home directory through tilde (~) character injection. If exploited, it may lead to exposure of sensitive data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Immediately update shescape to version 2.1.15 or later, or 3.0.2 or later if using version 3.0.0. Review code using shescape's escape or escapeAll APIs with untrusted input in assignment contexts to ensure proper handling of tilde characters.

Hi! I’m here to help you understand CVE-2026-73055. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70