CVE-2026-47144: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47144 is a path traversal vulnerability (CWE-22) in the shamefile tool that allows an attacker-controlled shamefile.yaml to disclose the contents of arbitrary files outside the repository, one line at a time, to the terminal of a user running the shame next command. It affects shamefile versions ≤ 0.1.6 across pip, npm, and Rust (cargo) package ecosystems. The vulnerability was published by the project maintainer (BKDDFS) on May 17, 2026, and added to the GitHub Advisory Database on May 28, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Security Advisory).

The root cause is improper path validation in the print_entry_snippet function within src/main.rs. In vulnerable versions (≤ 0.1.6), the function accepted the location field from a registry entry in shamefile.yaml and used it to construct a file path via registry_dir.join(entry.file()), then read and printed a line from that file to stdout — without verifying that the resolved path remained within the repository directory. An attacker could craft a shamefile.yaml with a location field containing either an absolute path (e.g., /etc/passwd:1) or a relative ../ traversal sequence pointing to a sensitive file outside the project root. The fix (commit 77b0aee) eliminates disk reads entirely: the snippet renderer now uses the cached content field stored in the registry entry itself, making the renderer disk-independent by construction (Patch Commit, Security Advisory).

Successful exploitation results in unauthorized disclosure of one line per invocation from any file readable by the user running shame next, including sensitive files such as credentials, private keys, or system configuration files (e.g., /etc/passwd, SSH keys, .env files). The impact is limited to confidentiality — there is no integrity or availability impact. Because exploitation requires user interaction (the victim must run shame next against a malicious shamefile.yaml) and is local in nature, the attack scope is constrained to the current user's file system permissions (GitHub Advisory).

1. Craft a malicious shamefile.yaml: Create a registry file with an entry whose location field points outside the repository — either using an absolute path (e.g., /etc/passwd:1 on Linux or C:\Windows\System32\drivers\etc\hosts:1 on Windows) or a relative traversal (e.g., ../../.ssh/id_rsa:1).
2. Deliver the malicious file: Place or substitute the crafted shamefile.yaml in a project directory that the target user is expected to work in (e.g., via a malicious repository, a compromised dependency, or social engineering).
3. Wait for victim to run shame next: When the victim executes shame next in the project directory, the vulnerable print_entry_snippet function reads the file at the attacker-controlled path and prints one line of its contents to the terminal.
4. Exfiltrate disclosed content: The attacker observes or captures the terminal output (e.g., via screen sharing, CI logs, or a shared environment) to obtain the leaked file line. Repeat with different line numbers in the location field to read additional lines (Patch Commit, Security Advisory).

• File System: Presence of a shamefile.yaml with location fields containing absolute paths (e.g., /etc/passwd, /home/user/.ssh/id_rsa) or ../ traversal sequences pointing outside the project root.
• Logs: Terminal or CI pipeline output from shame next displaying content that does not correspond to any source file within the repository (e.g., system file contents, credential strings).
• File System: Unexpected or externally sourced shamefile.yaml files in project directories, particularly those not matching the project's own linting suppression history.

Upgrade shamefile to version 0.1.7 or later across all package managers (pip, npm, cargo), which resolves the vulnerability by rendering snippets from the registry's cached content field instead of reading from disk (Release v0.1.7). As an interim workaround, do not run shame next against any shamefile.yaml from an untrusted source. For CI validation workflows, use shame me --dry-run instead, which does not trigger the vulnerable code path (Security Advisory).