CyberRota Analysis
AI-GeneratedThe Shamefile linter is vulnerable to a path traversal issue that allows an attacker to exploit an untrusted `shamefile.yaml` to disclose sensitive file contents outside the repository when the `shame next` command is executed. This could lead to unauthorized information exposure, impacting users who rely on this tool for linting undocumented warnings. Users and organizations utilizing Shamefile versions prior to 0.1.7 should prioritize upgrading to the patched version or implement the recommended workaround to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.