Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
BKDDFS shamefile affected
Version Status Constraints
< 0.1.7 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-x6p3-76f2-xxvh Shamefile has an arbitrary file read via shamefile.yaml in shame next
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/BKDDFS/shamefile/commit/77b0aeea318503582818c708518c601fedc43557 cve-icon
https://github.com/BKDDFS/shamefile/pull/80 cve-icon
https://github.com/BKDDFS/shamefile/releases/tag/v0.1.7 cve-icon
https://github.com/BKDDFS/shamefile/security/advisories/GHSA-x6p3-76f2-xxvh cve-icon
https://github.com/pypa/advisory-database/tree/main/vulns/shamefile/PYSEC-2026-3065.yaml cve-icon
History

Mon, 20 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Description Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.
Title Shamefile has an arbitrary file read via shamefile.yaml in shame next
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-20T21:49:09.058Z

Reserved: 2026-05-18T19:50:18.696Z

Link: CVE-2026-47144

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses