Home Directory Disclosure in Shescape on Unix Systems

CVE-2026-73055

What is CVE-2026-73055?

The Shescape library, prior to version 2.1.15 and 3.0.0 before 3.0.2, contains a vulnerability that arises from failing to properly escape tilde (~) characters in assignment contexts. This issue is particularly pertinent on Unix systems where the shell is configured to 'sh' or true and /bin/sh points to BusyBox. By utilizing the escape and escapeAll APIs with untrusted input, an attacker can exploit this weakness to inject tilde payloads. This may lead to the disclosure of the user's home directory, and in some cases, could allow the attacker to manipulate the command's operating environment.

References