CVSS
4.8
CVSS v3.1
EPSS
N/A
Exploit Prediction Score
Published
August 15, 2026
Exploitability
No EPSS data available
Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).