CVE-2022-24725 - CVE House

Back to Database

Status published Medium CVE-2022-24725

Exposure of home directory through shescape on Unix with Bash

6.2 CVSS

Vulnerability Description

Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, "\\~")`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24725

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ericcornelissen

View All →

Shescape has potential environment variable exposure on Windows with CMD

Shescape on Windows escaping may be bypassed in threaded context

Shescape potential environment variable exposure on Windows with CMD

Shescape Inefficient Regular Expression Complexity vulnerability

Insufficient escaping of whitespace in shescape

Affected Vendor

ericcornelissen

View all reports →

Affected Software

shescape

Vulnerable Versions:

>= 1.4.0, < 1.5.1

Timeline

Official Publish: March 3rd, 2022

Last Modified: April 22nd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel