External risk intelligence

Shescape Tilde Escape Vulnerability Discloses Home Directory.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73055

Shescape is a software library (code-level dependency) used by developers to escape command-line arguments. It is not an internet-facing service, appliance, or application, and its usage is inherently localized to the internal logic of the applications that incorporate it.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a flaw in the shescape software, which is used to manage command-line arguments. The vulnerability could allow an attacker to potentially reveal sensitive directory information or alter command operations by manipulating how certain characters are handled in specific shell environments. The primary concern is to confirm if this software is used within the organization and, if so, to understand the exposure.

Input flaws could expose sensitive location data.
Leadership should remember this if it affects internal tools.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending untrusted input to the escape or escapeAll APIs. This is particularly effective when the shell is configured to "sh" and /bin/sh points to BusyBox, allowing the attacker to inject a tilde character. Successfully exploiting this can reveal the user's home directory and potentially modify where commands operate.

Unsanitized input to specific APIs.
Assigning commands with tilde characters.
Home directory disclosure or command path alteration.

Live Threat

Current exploitation, exposure, and threat context

When an affected library is used with untrusted input in assignment contexts on specific Unix systems, it could reveal the user's home directory location. In certain scenarios, this could also influence where a command subsequently operates.

User's home directory location.
Untrusted input in assignments.
Disclose sensitive path information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application or platform team responsible for the build or runtime environment where Shescape is used should initiate the response. The first practical step is to identify all instances of the affected library, confirm its reachability within your environment, and determine which systems are business-critical before planning remediation.

Application or platform teams own this.
Verify Shescape usage and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Shescape and how is it used?

Shescape is a software library designed for developers to safely escape command-line arguments. It ensures that input intended for a shell is handled securely, preventing unintended command execution. Developers incorporate this library directly into their own applications as a dependency to manage how data is passed to external system processes.

What is the vulnerability in CVE-2026-73055?

This vulnerability is classified as CWE-116, which relates to improper encoding or escaping of special characters. In this specific case, the library fails to properly handle tilde characters when used in command assignment contexts. Because the library does not strip or escape these characters correctly, untrusted input can be processed by the shell in ways that were never intended.

How can this vulnerability be triggered?

An attacker needs to provide specific untrusted input to the library's escape or escapeAll APIs. The vulnerability specifically manifests on Unix systems where the shell is configured to use BusyBox as the default sh provider. It does not occur if the environment uses a different shell configuration or if the input does not involve variable assignments prefixed to commands.

Is this vulnerability relevant to my network?

According to Halo Surface Signal, this is a code-level dependency rather than a standalone network service. Because it operates within the internal logic of an application, it is not an internet-facing appliance. Relevance depends on whether your internal software uses the affected versions of the library to process untrusted user input.

What should I do if I use this software?

Start by identifying which of your applications include the affected library versions in their dependency tree. Once identified, consult your development teams to determine if the software is utilized in environments where BusyBox handles shell assignments. Prioritize checking business-critical applications first to plan for updates or dependency changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.