CVE-2026-47144

Name of the Vulnerable Software and Affected Versions shamefile versions prior to 0.1.7

Description A path traversal issue in shame next allows an attacker to use a malicious shamefile.yaml to disclose the contents of files located outside the repository. The information is leaked one line at a time to the terminal of the user executing the command. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Upgrade to version 0.1.7 or later. Do not run shame next against untrusted shamefile.yaml files. Use shame me --dry-run for CI validation.