The vulnerability resides in Shescape’s escape logic on Unix systems running the Dash shell: the library fails to escape the tilde (~) character when it follows a colon or equals sign during assignment construction. An attacker who can supply arbitrary input to the escape or escapeAll APIs can use a payload such as ":~" to cause the tilde to be interpreted as the user’s home directory. This results in the disclosure of the absolute home‑directory path, which may also redirect the command to run in a location chosen by the attacker. The weakness is a classic data transformation error (CWE‑116) combined with an information‑exposure flaw (CWE‑200).

The affected product is Shescape, a shell escape library for JavaScript, maintained by ericcornelissen. Versions earlier than 2.1.14 and earlier than 3.0.1 are vulnerable. All consumers of the library that invoke the escape or escapeAll functions on Unix platforms with Dash enabled (either explicitly or by default) are at risk; the issue does not appear in shells other than Dash or in later releases.

The CVSS score of 6.3 reflects moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation yet. Exploitation requires the attacker to be able to supply input to the escaping functions, which can be possible in any scenario where user data is passed without validation. The attack vector is a local or remote code path that controls untrusted input, and the outcome is direct disclosure of the user’s home directory, with the potential to redirect command execution to a location of the attacker’s choice.