Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-102422: shell-quote can let attackers run commands
CVE-2026-102422 · published 13 days ago
Summary
The shell-quote library used in Node.js projects can treat specially crafted text as a comment, allowing the rest of the line to be interpreted as a separate command. This means an attacker could cause the system to execute unintended commands. Upgrade to version 1.11.0 or later, which blocks this behavior, and review any code that builds shell commands from untrusted input.
What to do
- Update shell-quote to version 1.11.0.
- Update debian node-shell-quote to version 1.7.4+~1.7.1-1+deb13u2.
- Update debian node-shell-quote to version 1.12.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | – | shell-quote | < 1.11.0 |
| Ubuntu:Pro:18.04:LTS | canonical | node-shell-quote | All versions |
| Debian:12 | debian | node-shell-quote | All versions |
| npm | – | shell-quote |
>= 1.8.4, < 1.11.0 Fix: upgrade to 1.11.0
|
| Debian:13 | debian | node-shell-quote |
< 1.7.4+~1.7.1-1+deb13u2 Fix: upgrade to 1.7.4+~1.7.1-1+deb13u2
|
| Debian:14 | debian | node-shell-quote |
< 1.12.0-1 Fix: upgrade to 1.12.0-1
|
Original advisory text
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.
References
- https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a17...
- https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv
- https://github.com/ljharb/shell-quote
- https://www.npmjs.com/package/shell-quote
- https://ubuntu.com/security/CVE-2026-102422 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102422 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1024... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102422 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-102422 Vendor Advisory
- https://github.com/advisories/GHSA-pqg4-j6r4-53mv
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published29 Sep 2026
Updated11 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102422 · NVD
CVE-2026-102422 · MITRE
UBUNTU-CVE-2026-102422 · OSV
CVE-2026-102422 · OSV
GHSA-pqg4-j6r4-53mv · GHSA
DEBIAN-CVE-2026-102422 · OSV
GHSA-pqg4-j6r4-53mv · OSV
Track software like this
Free during beta