Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

shell-quote allows command injection through newline in op field

CVE-2026-9277 · published 4 months ago
Summary

The shell-quote library can turn a specially crafted input that includes a line break into two separate commands when it builds a shell command string. This means an attacker could cause unintended commands to run on the server. Update to the latest version of the library to get the fix that validates input and blocks line breaks.

What to do
  • Update debian node-shell-quote to version 1.8.4+~1.7.5-1.
  • Update ljharb shell-quote to version 1.8.4.
  • Update rootio @rootio/shell-quote to version 1.8.1-root.io.1.
  • Update ljharb shell-quote to version 1.8.1-aikido.1.
  • Update ljharb shell-quote to version 1.7.3-aikido.1.
  • Update rootio @rootio/shell-quote to version 1.7.3-root.io.1.
  • Update ljharb shell-quote to version 1.8.3-aikido.2.
  • Update rootio @rootio/shell-quote to version 1.8.3-root.io.2.
  • Update ljharb shell-quote to version 1.8.0-aikido.1.
  • Update rootio @rootio/shell-quote to version 1.8.0-root.io.1.
  • Update rootio @rootio/shell-quote to version 1.8.2-root.io.2.
  • Update ljharb shell-quote to version 1.7.2-aikido.1.
  • Update rootio @rootio/shell-quote to version 1.7.2-root.io.1.
  • Update ljharb shell-quote to version 1.8.2-aikido.2.
  • Update shell-quote to version 1.7.2-aikido.1.
  • Update debian node-shell-quote to version 1.7.4+~1.7.1-1+deb12u1.
  • Update debian node-shell-quote to version 1.7.4+~1.7.1-1+deb13u1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian node-shell-quote < 1.7.4+~1.7.1-1+deb12u1
Fix: upgrade to 1.7.4+~1.7.1-1+deb12u1
Debian:13 debian node-shell-quote < 1.7.4+~1.7.1-1+deb13u1
Fix: upgrade to 1.7.4+~1.7.1-1+deb13u1
Debian:14 debian node-shell-quote < 1.8.4+~1.7.5-1
Fix: upgrade to 1.8.4+~1.7.5-1
Ubuntu:Pro:18.04:LTS canonical node-shell-quote All versions
Ubuntu:Pro:22.04:LTS canonical node-shell-quote All versions
Ubuntu:24.04:LTS canonical node-shell-quote All versions
Ubuntu:25.10 canonical node-shell-quote All versions
Ubuntu:Pro:26.04:LTS canonical node-shell-quote All versions
npm ljharb shell-quote >= 1.1.0, <= 1.8.3
>= 1.1.0, < 1.8.4
Fix: upgrade to 1.8.4
Root:npm rootio @rootio/shell-quote < 1.8.1-root.io.1
< 1.7.3-root.io.1
< 1.8.3-root.io.2
< 1.8.0-root.io.1
< 1.8.2-root.io.2
< 1.7.2-root.io.1
Fix: upgrade to 1.8.1-root.io.1
Root:npm ljharb shell-quote < 1.8.1-aikido.1
< 1.7.3-aikido.1
< 1.8.3-aikido.2
< 1.8.0-aikido.1
< 1.7.2-aikido.1
< 1.8.2-aikido.2
Fix: upgrade to 1.8.1-aikido.1
– – shell-quote < 1.8.4
Root:npm – shell-quote < 1.7.2-aikido.1
Fix: upgrade to 1.7.2-aikido.1
Original advisory text
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published22 May 2026
Updated11 Oct 2026
First seen22 May 2026
Sources
CVE-2026-9277 · OSV
GHSA-w7jw-789q-3m8p · OSV
CVE-2026-9277 · MITRE
DEBIAN-CVE-2026-9277 · OSV
UBUNTU-CVE-2026-9277 · OSV
ROOT-APP-NPM-CVE-2026-9277 · OSV
GHSA-w7jw-789q-3m8p · GHSA
CVE-2026-9277 · NVD
Track software like this
Free during beta