CVE-2026-73055

Medium

Description

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.

SeverityMedium

CVSS4.8

Exploit probability—

ProductEriccornelissen Shescape

PublishedAug 15, 2026

First seenAug 15, 2026

Weakness typeCWE-116CWE-116 CWE-200Sensitive information exposure

How to fix

Update

ericcornelissen shescape2.1.15, 3.0.2 or later

Patches

Vendor advisories

github.com/ericcornelissen/shescape/security/advisories/GHSA-j44h-fqhh-fh28

Affected products

Product	Affected versions	Fixed in
ericcornelissen shescape	v < 2.1.15, 3.0.0 ≤ v < 3.0.2	2.1.15, 3.0.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.