Shescape is a JavaScript library that escapes shell input for use in Unix commands. On systems that use Zsh, the library’s escape and escapeAll functions can inadvertently trigger the shell’s extended globbing and home directory expansion, exposing file paths and directory listings. This flaw is rooted in CWE‑155 (Path Manipulation) and CWE‑78 (OS Command Injection), allowing an attacker to learn sensitive system information if the application supplies crafted input to these functions.

The vulnerability affects ericcornelissen’s shescape library on Unix platforms that employ the Zsh shell. Versions before 2.1.14 and 3.0.1 are susceptible when the application explicitly uses Zsh or defaults to it. Other shells or newer releases are not impacted.

The CVSS score of 6.3 indicates moderate severity for data disclosure. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack scenario requires an adversary to inject or influence input that passes through the escape or escapeAll functions while the process is running under Zsh; successful exploitation reveals directory contents that may serve as reconnaissance or credential gathering opportunities.