{"id":"GHSA-446w-rrm4-r47f","summary":"Exposure of home directory through shescape on Unix with Bash","details":"### Impact\n\nThe issue allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected.\n\n```javascript\nconst cp = require(\"child_process\");\nconst shescape = require(\"shescape\");\n\nconst payload = \"home_directory=~\";\nconst options = { interpolation: true };\nconsole.log(cp.execSync(`echo ${shescape.escape(payload, options)}`));\n// home_directory=/home/user\n```\n\nDepending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_.\n\n### Patches\n\nThe issue was patched in `v1.5.1`.\n\n### Workarounds\n\nManually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, \"\\\\~\")`.\n\n### References\n\nSee GitHub issue https://github.com/ericcornelissen/shescape/issues/169.\n","aliases":["CVE-2022-24725"],"modified":"2023-11-08T04:08:33.838531Z","published":"2022-03-03T19:26:11Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-03-03T19:26:11Z","nvd_published_at":"2022-03-03T22:15:00Z","cwe_ids":["CWE-200","CWE-78"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-446w-rrm4-r47f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24725"},{"type":"WEB","url":"https://github.com/ericcornelissen/shescape/issues/169"},{"type":"WEB","url":"https://github.com/ericcornelissen/shescape/pull/170"},{"type":"PACKAGE","url":"https://github.com/ericcornelissen/shescape"}],"affected":[{"package":{"name":"shescape","ecosystem":"npm","purl":"pkg:npm/shescape"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.5.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-446w-rrm4-r47f/GHSA-446w-rrm4-r47f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}