Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to escape tilde (~) characters when used in assignment contexts on Unix systems that have the shell explicitly configured to "sh" or true and /bin/sh points to BusyBox. Through the escape and escapeAll APIs, an attacker can inject a tilde payload into an untrusted input that precedes a command, enabling the disclosure of the current user's home directory path and, in some usage patterns, the alteration of the working directory on which the command executes.

The impacted software is the shescape_project's shescape Node.js library. Versions prior to 2.1.15 and before 3.0.2 are vulnerable. The flaw manifests on Unix-like environments where /bin/sh is linked to BusyBox and the shell is set to sh or true.

The CVSS score of 9.3 signifies a critical severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog, but the exploit remains feasible for any software that incorporates shescape and accepts user-supplied input for command construction. An attacker can leverage the library's escape functions locally or potentially within a compromised application to reveal the home directory and influence command execution, posing significant privacy and integrity risks.