https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 14:21:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-47144 <p><strong>Affected:</strong> BKDDFS shamefile</p> <p>Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.</p> <p><strong>Affected:</strong> BKDDFS shamefile</p> <p>Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.</p> https://vulnerability.circl.lu/vuln/cve-2026-47144 https://vulnerability.circl.lu/vuln/ghsa-x6p3-76f2-xxvh <p><strong>Affected:</strong> PyPI: shamefile, npm: shamefile, crates.io: shamefile</p> <p>### Impact</p> <p>A path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.</p> <p>### Patches</p> <p>Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.</p> <p>### Workarounds</p> <p>Do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.</p> <p>### Resources</p> <p>- Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557 - Pull request: https://github.com/BKDDFS/shamefile/pull/80 - Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7 - [CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;)](https://cwe.mitre.org/data/definitions/22.html)</p> <p><strong>Affected:</strong> PyPI: shamefile, npm: shamefile, crates.io: shamefile</p> <p>### Impact</p> <p>A path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.</p> <p>### Patches</p> <p>Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.</p> <p>### Workarounds</p> <p>Do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.</p> <p>### Resources</p> <p>- Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557 - Pull request: https://github.com/BKDDFS/shamefile/pull/80 - Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7 - [CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;)](https://cwe.mitre.org/data/definitions/22.html)</p> https://vulnerability.circl.lu/vuln/ghsa-x6p3-76f2-xxvh