CVE-2026-47144: Shamefile Path Traversal Vulnerability

CVE-2026-47144 Overview

CVE-2026-47144 is a path traversal vulnerability [CWE-22] in Shamefile, a linter for undocumented linter warnings. The flaw affects the shame next command in versions prior to 0.1.7. An attacker-controlled shamefile.yaml can force the tool to read files outside the repository and disclose their contents, one line at a time, to the terminal of the user executing the command. Exploitation requires local access and user interaction, since a victim must run shame next against a malicious configuration file. The maintainers fixed the issue in version 0.1.7.

Critical Impact
A malicious shamefile.yaml can leak arbitrary file contents from the host filesystem to the terminal of any developer who runs shame next against it.

Affected Products

Shamefile versions prior to 0.1.7
Python projects consuming Shamefile from PyPI
CI/CD pipelines invoking shame next against untrusted repositories

Discovery Timeline

2026-07-20 - CVE-2026-47144 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47144

Vulnerability Analysis

Shamefile is a linter that tracks undocumented linter warnings recorded in a project-level shamefile.yaml. The shame next subcommand reads entries from this configuration file and displays the next warning to remediate. The command trusts file path values inside the YAML without constraining them to the repository root. When an attacker supplies a shamefile.yaml containing traversal sequences such as ../../etc/passwd, the tool follows those paths and prints the referenced file's contents to the terminal, one line per invocation.

The vulnerability is triggered locally, but the attacker-controlled input can travel across trust boundaries. A malicious repository, a compromised branch, or a pull request from an external contributor can carry a poisoned shamefile.yaml. Developers who clone the repository and run shame next as part of normal review then unknowingly disclose sensitive files, including SSH keys, cloud credentials, or environment configuration accessible to their user account.

Root Cause

The root cause is missing path validation and canonicalization when resolving file paths supplied by shamefile.yaml. The shame next code path does not verify that resolved paths remain within the repository directory before opening and printing file contents. This is a classic path traversal weakness classified under [CWE-22]. Fix details are available in the patch commit 77b0aeea318503582818c708518c601fedc43557.

Attack Vector

Exploitation requires local execution and user interaction. An attacker crafts a shamefile.yaml containing traversal sequences pointing to files outside the repository. When a victim runs shame next against the crafted file, Shamefile resolves the path, opens the target file, and writes a line of its content to the terminal. Repeated invocations disclose additional lines. The vulnerability does not allow modification of files and does not affect availability.

See the GitHub Security Advisory GHSA-x6p3-76f2-xxvh and the patch commit for technical details.

Detection Methods for CVE-2026-47144

Indicators of Compromise

Presence of path traversal sequences such as ../ or absolute paths in shamefile.yaml entries.
shame next invocations that print content from files outside the current repository tree.
Unexpected reads of sensitive files (for example ~/.ssh/id_rsa, ~/.aws/credentials, /etc/passwd) shortly after running Shamefile commands.

Detection Strategies

Scan repositories and pull requests for shamefile.yaml files whose path fields contain .., leading /, or symbolic link targets that escape the repository root.
Audit installed Shamefile versions across developer workstations and CI runners, flagging any release earlier than 0.1.7.
Review CI logs for shame next output that references paths outside the workspace directory.

Monitoring Recommendations

Monitor process execution and file access telemetry on developer endpoints for shame next invocations followed by reads of credential or configuration files.
Alert on Shamefile processes opening file handles outside the current working directory tree.
Track PyPI package versions installed in build environments and flag downgrades or pinned versions below 0.1.7.

How to Mitigate CVE-2026-47144

Immediate Actions Required

Upgrade Shamefile to version 0.1.7 or later on all developer workstations, containers, and CI/CD runners.
Inventory repositories that include a shamefile.yaml and review each file for suspicious path entries.
Rotate any credentials that may have been printed to shared terminals or CI logs by prior shame next runs.

Patch Information

The issue is fixed in Shamefile 0.1.7. See the GitHub Release v0.1.7, the merged pull request, and the PyPA advisory PYSEC-2026-3065 for release and packaging details.

Workarounds

Do not run shame next against untrusted shamefile.yaml files, including those from external contributors or unreviewed branches.
Use shame me --dry-run for CI validation instead of shame next until upgrades are complete.
Restrict Shamefile execution in CI to isolated containers with minimal filesystem access to sensitive credentials.

bash

# Upgrade Shamefile to the patched release
pip install --upgrade 'shamefile>=0.1.7'

# Verify the installed version
shame --version

# Use dry-run validation in CI instead of `shame next`
shame me --dry-run