CVE-2026-47144 json
Shamefile has an arbitrary file read via shamefile.yaml in shame next
published 2026-05-28 5 mo ago modified 2026-10-24 15 d ago also GHSA-x6p3-76f2-xxvh , PYSEC-2026-3065 , EUVD-2026-46117
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.
Patch / fix
- pypi shamefile 0.1.7
- npm shamefile 0.1.7
- crates.io shamefile 0.1.7
- github.com/BKDDFS/shamefile@77b0aee commit
- github.com/BKDDFS/shamefile#80 pull request
- github.com/BKDDFS/shamefile/releases/tag/v0.1.7 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | shamefile | <0.1.7 |
0.1.7 |
| npm | shamefile | <0.1.7 |
0.1.7 |
| crates.io | shamefile | <0.1.7 |
0.1.7 |
Affected products
- BKDDFS shamefile
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/BKDDFS/shamefile/pull/80
web
-
github.com
/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557
web
-
github.com
/BKDDFS/shamefile/security/advisories/GHSA-x6p3-76f2-xxvh
web
-
github.com
/BKDDFS/shamefile/releases/tag/v0.1.7
web
-
github.com
/pypa/advisory-database/tree/main/vulns/shamefile/PYSEC-2026-3065.yaml
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-47144
advisory
-
github.com
/BKDDFS/shamefile
package
-
pypi.org
/project/shamefile
package
-
github.com
/advisories/GHSA-x6p3-76f2-xxvh
advisory
Sources
- CVE List CVE-2026-47144
- GitHub Advisory GHSA-x6p3-76f2-xxvh
- NVD CVE-2026-47144
- OSV PYSEC-2026-3065
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.