GHSA-q53c-4prm-w95q: Unix Home Directory Path Disclosure and Command Escaping Flaws in Shescape

The npm package shescape serves as an escaping utility for Node.js applications, protecting shell command execution against parameter injections and unintended argument interpretation. Applications typically utilize this package to sanitize untrusted inputs before passing them to internal execution APIs.

This vulnerability, tracked under GHSA-q53c-4prm-w95q, describes a path disclosure flaw when executing within environments that use the Dash shell (either configured explicitly or operating as the system default). The bug permits an attacker to bypass shell escaping and force the system to expand shell-interpreted paths.

Simultaneously, the maintainers addressed secondary parsing weaknesses within Zsh and Windows CMD parsing routines. In Zsh, the presence of specific globbing control characters could alter pattern-matching behavior. Under Windows CMD, raw parenthetical delimiters were not correctly neutralized, allowing command block escapes.

In POSIX-compliant environments, Dash handles tilde expansion (~) by replacing it with the absolute path of the user's home directory. While this expansion normally occurs only at word boundaries or following whitespace, shell-specific variable assignments broaden this evaluation scope.

Inside a shell variable assignment context (e.g., VAR=val), the shell parses the assigned value and performs tilde expansion immediately following equals signs (=) or colons (:). This allows paths inside environment variable configurations like PATH to be dynamically resolved.

Prior to the security patch, shescape evaluated Dash-specific tildes using a restricted regular expression pattern: /(^|\s)~/g. This pattern only identified and escaped a tilde character if it appeared at the absolute beginning of the input string or immediately after a whitespace character.

Because the regex failed to recognize equals signs or colons as valid expansion boundaries, payloads containing characters like :~ bypassed the escaping mechanism. When integrated into a shell assignment command, Dash processed the unescaped tilde, resulting in sensitive system path disclosure.

The technical fix was implemented across multiple internal libraries corresponding to each shell environment. In src/internal/unix/dash.js, the regex used to detect home directory tildes was updated to prevent assignment-context expansion.

@@ -16,7 +16,7 @@ export function getEscapeFunction() {
   const newlines = new RegExp(/\n/g);
   const backslashes = new RegExp(/\\/g);
   const comments = new RegExp(/(^|\s)#/g);
-  const home = new RegExp(/(^|\s)~/g);
+  const home = new RegExp(/(^|[\s:=])~/g);
   const specials = new RegExp(/(["$&'()*;<>?[\]`|])/g);
   const whitespace = new RegExp(/([\t ])/g);

Expanding the pattern to /(^|[\s:=])~/g ensures that tildes located after spaces, colons, or equals signs are properly escaped. This prevents Dash from recognizing the tilde as an expansion initiator within environment parameters.

In the Zsh escaping library src/internal/unix/zsh.js, the update consolidated various glob and expansion operators directly into the unconditional specials filter.

@@ -15,17 +15,15 @@ export function getEscapeFunction() {
   const controls = new RegExp(/[\0\u0008\r\u001B\u009B]/g);
   const newlines = new RegExp(/\n/g);
   const backslashes = new RegExp(/\\/g);
-  const comments = new RegExp(/(^|\s)#/g);
-  const expansions = new RegExp(/(^|\s)([=~])/g);
-  const specials = new RegExp(/(["$&'()*;<>?[\]`{|}])/g);
+  const expansions = new RegExp(/(^|[\s:=])=/g);
+  const specials = new RegExp(/(["#$&'()*;<>?[\]^`{|}~])/g);
   const whitespace = new RegExp(/([\t ])/g);

Moving #, ^, and ~ into the specials regex means they are now unconditionally backslash-escaped. This prevents glob execution when Zsh is configured with EXTENDED_GLOB enabled. For Windows CMD, parenthetical characters ( and ) were added to the specials regex inside src/internal/win/cmd.js to prevent command breakout.

To trigger the path disclosure vulnerability, an attacker must target an application utilizing a vulnerable version of shescape under a Dash shell environment. The resulting output must then be integrated directly into a variable assignment inside the executed shell command.

An attacker supplies the payload :~ through an untrusted input parameter. The escaping logic in shescape ignores this input sequence, returning the payload verbatim without applying backslash-escaping.

When the application processes this output dynamically into a command such as cp.execSync('VAR=' + escapedPayload), the resulting instruction evaluated by the shell is VAR=:~. The Dash parser evaluates this string inside the assignment block and expands the tilde.

// Proof-of-concept demonstrating path disclosure
import * as cp from "node:child_process";
import { Shescape } from "shescape";
 
const options = { shell: "dash" };
const shescape = new Shescape(options);
const payload = ":~";
const escapedPayload = shescape.escape(payload); 
 
// Returns vulnerable payload unmodified because of the regex gap
const result = cp.execSync(`V=${escapedPayload}; echo $V`, options);
console.log(result.toString());
// Vulnerable output leaks absolute user path: ":/home/node-user"

This bypass allows unauthorized extraction of path details, mapping the internal directory structure of the host container or server.

The primary outcome of exploiting this flaw is system information leakage (CWE-200). Exposing the home directory path reveals structural elements of the host environment, such as user account names and localized application paths.

This information exposure acts as a precursor for more severe exploitation chains. Attackers can leverage absolute path knowledge to fine-tune local file inclusion (LFI) attempts, target specific file paths during directory traversal, or weaponize secondary logical flaws.

For Windows environments, the parenthetical breakout addressed in the CMD patch carries a high security impact. If untrusted input is interpolated within a parenthetical block, an attacker can prematurely close the block and append arbitrary execution commands.

The vulnerability is rated with a CVSS v4 score of 6.3, highlighting its network-based delivery and low complexity, limited by specific shell execution requirements. Due to its registry-only advisory status, it does not have a traditional CVE index, causing potential gaps in signature-based scanner databases.

The recommended resolution is updating the shescape library dependency to a secure release. For projects using the v2 release branch, update to 2.1.14 or later; for v3 installations, update to 3.0.1 or later.

If upgrading is not immediately possible, applications should pass dynamic parameters to child execution processes using environment variable dictionaries rather than string concatenation in a raw shell command.

// Secure parameter passing implementation
import * as cp from "node:child_process";
 
cp.execFile("task-executable", [], {
  env: { ...process.env, USER_INPUT: untrustedInput }
});

Additionally, applications can filter incoming inputs to block strings that contain tildes (~) or colons (:) preceding structural characters. Restricting the use of shell spawning and moving to safer parameter-based execution layers reduces the overall attack surface.