CVE-2022-24725

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24725
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24725.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24725
Aliases
Published
2022-03-03T21:35:10Z
Modified
2026-04-02T07:49:51.832526Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Exposure of home directory through shescape on Unix with Bash
Details

Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the escape or escapeAll functions from the shescape API with the interpolation option set to true. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of shescape is used, directory traversal may be possible in the application using shescape. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (~) using arg.replace(/~/g, "\\~").

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24725.json"
}
References

Affected packages

Git / github.com/ericcornelissen/shescape

Affected ranges

Type
GIT
Repo
https://github.com/ericcornelissen/shescape
Events
Introduced
8e0d66f7d69d12c96dce8fc9c539b7d9390dc425
Fixed
542532a64e24ea85044259345451010ca0cce71e

Affected versions

v1.*
v1.4.0
v1.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24725.json"