p PatchFirst

CVE-2026-9277

CVE-2026-9277 · shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

CVSS 9.2 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • shell-quote

    Versions
    • ≥ 1.1.0, < 1.8.4: Affected (semver)

    Update to 1.8.4

  • node-shell-quote Debian:12

    Versions
    • 1.7.4+~1.7.1-1
    Affected ranges
    • ECOSYSTEM: < 1.7.4+~1.7.1-1+deb12u1

    Update to 1.7.4+~1.7.1-1+deb12u1

  • node-shell-quote Debian:13

    Versions
    • 1.7.4+~1.7.1-1
    Affected ranges
    • ECOSYSTEM: < 1.7.4+~1.7.1-1+deb13u1

    Update to 1.7.4+~1.7.1-1+deb13u1

  • node-shell-quote Debian:14

    Versions
    • 1.7.4+~1.7.1-1
    • 1.7.4+~1.7.1-2
    • 1.8.3+~1.7.5-1
    Affected ranges
    • ECOSYSTEM: < 1.8.4+~1.7.5-1

    Update to 1.8.4+~1.7.5-1

  • shell-quote npm

    Affected ranges
    • SEMVER: ≥ 1.1.0, < 1.8.4

    Update to 1.8.4

  • node-shell-quote Ubuntu:Pro:18.04:LTS

    Versions
    • 1.6.1+20160617-git72fb5a8ce29b-1
    Affected ranges
    • ECOSYSTEM: < 1.6.1+20160617-git72fb5a8ce29b-1ubuntu0.1~esm1

    Update to 1.6.1+20160617-git72fb5a8ce29b-1ubuntu0.1~esm1

  • node-shell-quote Ubuntu:Pro:22.04:LTS

    Versions
    • 1.7.3+~1.7.1-1
    Affected ranges
    • ECOSYSTEM: < 1.7.3+~1.7.1-1ubuntu0.1~esm1

    Update to 1.7.3+~1.7.1-1ubuntu0.1~esm1

  • node-shell-quote Ubuntu:24.04:LTS

    Versions
    • 1.7.4+~1.7.1-1
    Affected ranges
    • ECOSYSTEM: < 1.7.4+~1.7.1-1ubuntu0.24.04.1

    Update to 1.7.4+~1.7.1-1ubuntu0.24.04.1

  • node-shell-quote Ubuntu:25.10

    Versions
    • 1.7.4+~1.7.1-1
    Affected ranges
    • ECOSYSTEM: < 1.7.4+~1.7.1-1ubuntu0.25.10.1

    Update to 1.7.4+~1.7.1-1ubuntu0.25.10.1

  • node-shell-quote Ubuntu:26.10

    Versions
    • 1.8.3+~1.7.5-1
    • 1.9.0+~1.7.5-1
    • 1.10.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-shell-quote Ubuntu:Pro:26.04:LTS

    Versions
    • 1.7.4+~1.7.1-1
    • 1.8.3+~1.7.5-1
    Affected ranges
    • ECOSYSTEM: < 1.8.3+~1.7.5-1ubuntu0.1~esm1

    Update to 1.8.3+~1.7.5-1ubuntu0.1~esm1

Original sources

Check your server →