CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
- Record
CVE-2026-47144- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-46117
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
- Record
EUVD-2026-46117- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x6p3-76f2-xxvh
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Impact
A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.
Patches
Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.
Workarounds
Do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
Resources
- Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557
- Pull request: https://github.com/BKDDFS/shamefile/pull/80
- Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Record
GHSA-x6p3-76f2-xxvh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
- Record
CVE-2026-47144- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
- Record
CVE-2026-47144- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-x6p3-76f2-xxvh
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Impact
A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.
Patches
Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.
Workarounds
Do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
Resources
- Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557
- Pull request: https://github.com/BKDDFS/shamefile/pull/80
- Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Record
GHSA-x6p3-76f2-xxvh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-3065
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Impact
A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.
Patches
Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.
Workarounds
Do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.
Resources
- Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557
- Pull request: https://github.com/BKDDFS/shamefile/pull/80
- Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Record
PYSEC-2026-3065- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shamefilePyPI |
through 0.1.6 | 0.1.7 |
shamefilenpm |
through 0.1.6 | 0.1.7 |
shamefilecrates.io |
through 0.1.6 | 0.1.7 |
shamefilePyPI |
before 0.1.7, plus listed versions 0.1.00.1.0rc20.1.0rc30.1.10.1.2 Show 4 moreShow less0.1.30.1.40.1.50.1.6 |
0.1.7 |
shamefilenpm |
before 0.1.7 | 0.1.7 |
shamefilecrates.io |
before 0.1.7 | 0.1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47144 is a medium vulnerability (CVSS 5.5) in Bkddfs Shamefile, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in shamefile 0.1.7.
References
github.com/BKDDFS/shamefile/security/advisories/GHSA-x6p3-76f2-xxvh
nvd.nist.gov/vuln/detail/CVE-2026-47144