{"id":"CVE-2026-47144","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T22:17:15.263","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation."},{"lang":"es","value":"Shamefile es un linter para advertencias de linter indocumentadas. Antes de la versión 0.1.7, una vulnerabilidad de salto de ruta en ’shame next’ permite que un ’shamefile.yaml’ controlado por un atacante divulgue el contenido de archivos fuera del repositorio, una línea a la vez, al terminal de un usuario que ejecuta el comando. Vea el commit del parche para detalles técnicos. El problema está solucionado en 0.1.7. Actualice a la versión 0.1.7 o a versiones posteriores para incorporar el parche. Como solución alternativa, no ejecute ’shame next’ contra un ’shamefile.yaml’ no confiable. Use ’shame me --dry-run’ para la validación de CI."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"BKDDFS","product":"shamefile","versions":[{"version":"< 0.1.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-22T14:18:03.366161Z","id":"CVE-2026-47144","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557","source":"security-advisories@github.com"},{"url":"https://github.com/BKDDFS/shamefile/pull/80","source":"security-advisories@github.com"},{"url":"https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7","source":"security-advisories@github.com"},{"url":"https://github.com/BKDDFS/shamefile/security/advisories/GHSA-x6p3-76f2-xxvh","source":"security-advisories@github.com"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/shamefile/PYSEC-2026-3065.yaml","source":"security-advisories@github.com"}]}