CVE-2026-73055

Katalog CVE

CVSS 4.8 · Medium EPSS 0,36%

Kerentanan Improper Encoding or Escaping of Output. Skor CVSS 3.1 4.8 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.

Rincian

Terbit di NVD

15 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Deferred

CVSS 3.1

4.8 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ericcornelissen/shescape/commit/7cba30594c16a21524706efe2f6c6c9d8923f411
• https://github.com/ericcornelissen/shescape/commit/d86bf2ae22961c73458bddf70dd06adf9dadb36c
• https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j44h-fqhh-fh28
• https://www.vulncheck.com/advisories/shescape-before-home-directory-disclosure-via-busybox