CVE-2026-47144 PUBLISHED

Shamefile has an arbitrary file read via shamefile.yaml in shame next

Assigner: GitHub_M
Reserved: 18.05.2026 Published: 20.07.2026 Updated: 20.07.2026

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS Score: 5.5

Product Status

Vendor BKDDFS
Product shamefile
Versions
  • Version < 0.1.7 is affected

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE