[shescape] Shescape has possible misidentification of shell due to link chains

**[shescape] Shescape has possible misidentification of shell due to link chains**

Impact This impacts users of Shescape that configure their shell to point to a file on disk that is a link to a link. The precise result of being affected depends on the actual shell used and incorrect shell identified by Shescape. In particular, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information, consider the following proof of concept (targeting Shescape v2): import fs from "node:fs"; import { exec } from "node:child_process"; import { Shescape } from "shescape"; import which from "which"; /* 1. Set up */ const shell = which.sync("bash"); const linkToShell = "./csh"; const linkToLink = "./link"; fs.rmSync(linkToLink, { force: true }); fs.rmSync(linkToShell, { force: true }); fs.symlinkSync(shell, linkToShell); fs.symlinkSync(linkToShell, linkToLink); /* 2...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.