CyberRota Analysis
AI-GeneratedShescape versions prior to 2.1.15 and 3.0.0 before 3.0.2 are vulnerable due to improper escaping of tilde characters in assignment contexts on Unix systems configured with "sh" or true, where /bin/sh points to BusyBox. This vulnerability allows an attacker to inject a tilde payload through the escape and escapeAll APIs, potentially disclosing the user's home directory and altering command execution locations. Organizations using affected versions of Shescape should prioritize patching to mitigate the risk of unauthorized information disclosure and command manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.