CVE-2026-47144: Shamefile has an arbitrary file read via shamefile.yaml in shame next
(updated )
A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details.
References
- github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557
- github.com/BKDDFS/shamefile/pull/80
- github.com/BKDDFS/shamefile/releases/tag/v0.1.7
- github.com/BKDDFS/shamefile/security/advisories/GHSA-x6p3-76f2-xxvh
- github.com/advisories/GHSA-x6p3-76f2-xxvh
- github.com/pypa/advisory-database/tree/main/vulns/shamefile/PYSEC-2026-3065.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-47144
Code Behaviors & Features
Detect and mitigate CVE-2026-47144 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →