5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47144

CVE-2026-47144: Shamefile has an arbitrary file read via shamefile.yaml in shame next

Impact

A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.

Patches

Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch.

Workarounds

Do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation.

Resources

Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557
Pull request: https://github.com/BKDDFS/shamefile/pull/80
Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47144

CVE-2026-47144:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
shamefile	pip	<= 0.1.6	0.1.7
shamefile	npm	<= 0.1.6	0.1.7
shamefile	rust	<= 0.1.6	0.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in the shame next command of the shamefile tool. The root cause lies in the print_entry_snippet function, which was responsible for displaying a code snippet for a given shame entry. This function improperly trusted the location field from the shamefile.yaml file, which can be controlled by an attacker.

The vulnerable version of print_entry_snippet would construct a file path based on this location and read the file from the disk to generate the snippet. An attacker could create a malicious shamefile.yaml where the location for an entry points to a sensitive file on the user's system (e.g., /etc/passwd or SSH keys) using path traversal sequences (../) or absolute paths.

When a victim runs the shame next command in a repository containing this malicious shamefile.yaml, the print_entry_snippet function would be called. It would then proceed to read the specified sensitive file and print one line of its content to the user's terminal, leading to information disclosure.

The patch resolves this vulnerability by fundamentally changing how the snippet is generated. The print_entry_snippet function no longer reads from the file system. Instead, it now relies on a content field within the shame entry itself, which is a pre-cached copy of the relevant line of code. This change, verified by the new test format_entry_snippet_uses_content_field_not_filesystem, effectively severs the connection between snippet rendering and direct file access, thus mitigating the path traversal risk.

Vulnerable functions

shamefile::print_entry_snippet

src/main.rs

The `print_entry_snippet` function was vulnerable to path traversal. It would construct a file path from the `location` field of an entry in `shamefile.yaml` and then read the content of that file. An attacker could craft a `shamefile.yaml` with a specially crafted `location` (e.g., using `../` or an absolute path) to point to a sensitive file on the system. When a user ran `shame next`, this function would read one line from the targeted sensitive file and display it in the terminal.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.