CVE-2026-73055 in shescape
Summary
by MITRE • 08/16/2026
Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability affects shescape versions prior to 2.1.15 and 3.0.0 before 3.0.2, specifically impacting Unix systems where the shell is explicitly configured to use "sh" or true commands with /bin/sh pointing to BusyBox implementations. The core issue stems from improper handling of tilde (~) character escaping in assignment contexts, creating a significant security risk for command injection scenarios. When developers use the escape and escapeAll APIs with untrusted input in assignment prefixes preceding commands, attackers can exploit this flaw to inject malicious tilde payloads that reveal user home directory locations through shell expansion mechanisms.
The technical flaw manifests when shescape fails to properly sanitize tilde characters during shell escaping operations, particularly in contexts where assignments are made to shell variables before command execution. In BusyBox environments, the tilde expansion behavior differs from standard bash implementations, creating unexpected code paths where attacker-controlled input can be interpreted as directory references rather than literal string values. This vulnerability specifically targets assignment contexts because the shell processes tilde expansion within variable assignments, allowing attackers to manipulate the effective working directory or target location of subsequent commands through carefully crafted payloads.
The operational impact of this vulnerability extends beyond simple information disclosure, potentially enabling more sophisticated attacks depending on how the escaped input is utilized. An attacker who successfully injects a tilde payload can not only determine the user's home directory structure but also manipulate command execution targets by redirecting operations to unintended locations within the filesystem hierarchy. This capability becomes particularly dangerous when combined with other exploitation techniques or when the vulnerable application executes commands with elevated privileges, as it could enable path traversal attacks or privilege escalation scenarios.
From a cybersecurity perspective, this vulnerability aligns with CWE-78 and CWE-80, representing command injection and input validation weaknesses respectively. The flaw maps to ATT&CK technique T1059.004 for Unix shell commands and T1021.004 for remote services, as it enables attackers to execute arbitrary commands through improper input handling in shell environments. Organizations should prioritize updating shescape to versions 2.1.15 or 3.0.2 respectively, implementing proper input validation at multiple layers, and conducting thorough code reviews focusing on shell escaping mechanisms. Additional mitigations include deploying runtime protections that monitor for suspicious tilde character sequences in command execution contexts and establishing secure coding practices that avoid direct shell command construction from user-provided inputs without proper sanitization measures.