@rse/claudex (1.0.11) potentially affected by CVE-2026-73055 via shescape (3.0.1)

shescape NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on shescape and may be impacted: - @rse/claudex 1.0.11 Source cves: CVE-2026-73055 Source advisory: SNYK:JS-SHESCAPE-18855681...

@rse/claudex (>=0.9.22, <=1.0.10), @snyk/snyk-cocoapods-plugin (>=2.6.0, <=3.1.2) +6 more potentially affected by CVE-2026-73055 via shescape (>=2.1.0, <=2.1.14)

shescape NPM version =2.1.0, =0.9.22, =2.6.0, =2.0.0, =8.0.0, =6.0.0, =3.0.0, =3.0.0, =3.1.4 Source cves: CVE-2026-73055 Source advisory: SNYK:JS-SHESCAPE-18855681...

CVE-2026-73055

creationtimestamp| type| source ---|---|--- 2026-08-15 23:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt5sqnsrdp2p 2026-08-16 00:00:37+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mt5uz67kqo2w 2026-08-16 00:00:39+00:00| seen|...

CVE-2026-73055 Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...