{"id":"CVE-2026-9277","aliases":["GHSA-w7jw-789q-3m8p"],"url":"https://o3.security/vulnerability/CVE-2026-9277","summary":"shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`","details":"shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.","published":"2026-05-22T13:22:38.873Z","modified":"2026-09-06T03:30:16.454844590Z","cvss":null,"epss":{"score":0.00848,"percentile":0.55633,"asOf":"2026-09-02"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"shell-quote","fixedVersion":"1.8.4"}],"fix":{"url":"https://github.com/ljharb/shell-quote/commit/1518179","label":"ljharb/shell-quote@1518179"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/05/23/2"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json"},{"type":"WEB","url":"https://www.npmjs.com/package/shell-quote"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26072"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26077"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26079"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26080"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26090"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26225"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28010"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29197"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29834"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30076"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33574"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33683"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36754"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40765"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41066"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44237"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44263"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44267"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48699"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50850"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56854"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56912"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60023"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-9277"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9277.json"},{"type":"ADVISORY","url":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9277"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480741"},{"type":"FIX","url":"https://github.com/ljharb/shell-quote/commit/1518179"},{"type":"PACKAGE","url":"https://github.com/ljharb/shell-quote"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-06T03:30:16.454844590Z"}}