Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

shamefile

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5crates.ioAmendedPublished

    Shamefile has an arbitrary file read via shamefile.yaml in shame next

    CVE-2026-47144 · GHSA-x6p3-76f2-xxvh

    Affected
    • crates.io shamefile <= 0.1.6
    Fixed in
    0.1.7· Vendor fix available
    Issue
    Impact A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. Patches Fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. Workarounds Do not run shame next against untrusted shamefile.yaml. Use shame me --dry-run for CI validation. Resources - Patch commit: https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557 - Pull request: https://github.com/BKDDFS/shamefile/pull/80 - Release: https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7 - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    Recommended action: Upgrade to 0.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →