Skip to content
Fencer Vulns
high 8.1

CVE-2026-102422 json

shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token

published 2026-09-29 41 d ago modified 2026-10-06 33 d ago also GHSA-pqg4-j6r4-53mv , EUVD-2026-88629

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.

Patch / fix

  • npm shell-quote 1.11.0
  • node-shell-quote Debian 13 1.7.4+~1.7.1-1+deb13u2
  • node-shell-quote Debian 14 1.12.0-1

debian advisories DEBIAN-CVE-2026-102422

  • prometheus3.13 hummingbird 1 3.13.3-0.2.hum1
  • jaeger hummingbird 1 2.20.0-0.11.hum1
  • grafana13.2 hummingbird 1 13.2.1-0.8.hum1
  • grafana13.1 hummingbird 1 13.1.6-0.4.hum1

red hat advisories RHSA-2026:72750RHSA-2026:69544RHSA-2026:72507RHSA-2026:72498

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-102422 updated cvss 8.1

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, rhoai/odh-mod-arch-autorag-rhel9, rhoai/odh-mod-arch-eval-hub-rhel9, +3 more Red Hat OpenShift Dev Spaces devspaces/code-rhel9
    affected: workaround, no fix available
  • Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1792603924, discovery/discovery-ui-rhel9 1793218530
    fixed: vendor fix RHSA-2026:92136
  • Red Hat Hardened Images jaeger 2.20.0-0.11.hum1, grafana13.1 13.1.6-0.4.hum1, grafana13.2 13.2.1-0.8.hum1, prometheus3.13 3.13.3-0.2.hum1
    fixed: vendor fix RHSA-2026:72498
  • Red Hat Cryostat 4 cryostat/cryostat-openshift-console-plugin-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat AMQ Broker 7 amq-broker-bin.zip 7.14.1.CR3, amq-broker-maven-repository.zip 7.14.1.CR3 Red Hat Ansible Automation Platform 2 automation-controller 4.5.36-1.el9ap, automation-platform-ui 2.6.14-1.el9ap, automation-gateway 2.5.20260923-1.el9ap, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, automation-eda-controller 1.0.10-0.1.20260317.git9cae940.el8ap Red Hat build of Apache Camel - HawtIO 4 rhaf-hawtio-maven-repository.zip 4.4.0.GA
    +11 more products
    Red Hat Build of Podman Desktop rh-podman-desktop a4ea1f988eb28bc86ab3516bba3a4973b252a17e Red Hat Connectivity Link 1 rhcl-1/rhcl-rhdh-dynamic-plugin-rhel9 Red Hat Data Grid 8 redhat-datagrid-maven-repository.zip 8.6.1.CR1 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 discovery/discovery-server-rhel9 1792604013, discovery/discovery-server-rhel9 1793218657 Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-pcp, grafana-loki, grafana-mssql, +12 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-pcp, grafana-selinux, pcs 0.12.0-3.el10_0.5 Red Hat Enterprise Linux 10 grafana, grafana-pcp, pcs 0.12.0-3.el10_0.5 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 shell-quote 1.7.2 Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9
    not affected: vulnerable code not present
  • Red Hat Quay 3 quay/quay-rhel8
    not affected: vulnerable code not in execute path
  • Red Hat Trusted Artifact Signer rhtas/rekor-search-ui-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
39 d ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm shell-quote
>=1.8.4, <1.11.0
1.11.0

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.