Skip to content
Fencer Vulns
high 8.1

CVE-2026-9277 json

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

published 2026-05-22 5 mo ago modified 2026-09-14 55 d ago also GHSA-w7jw-789q-3m8p , EUVD-2026-31440

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

Patch / fix

  • npm shell-quote 1.8.4
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-10
  • Red Hat Cluster Observability Operator 1.5.0 1782838476, 1782838753, 1782839193, 1782839279, 1782839494, 1782839658, 1782839981, 1782839996, 1782840519, 1782840539, 1782841925, 1782844225
  • Red Hat Red Hat Ansible Automation Platform 2.1 1785854226
  • Red Hat Red Hat Developer Hub 1.10 1783448184
  • Red Hat Red Hat Developer Hub 1.9 1782761244
  • Red Hat Red Hat Discovery 2 1782166952
  • Red Hat Red Hat Migration Toolkit 1.8 1783690532
  • Red Hat Red Hat OpenShift Container Platform 4.14 1788218669
  • Red Hat Red Hat OpenShift Container Platform 4.15 1787028559
  • Red Hat Red Hat OpenShift Container Platform 4.16 1787054159
  • Red Hat Red Hat OpenShift Container Platform 4.17 1787631382
  • Red Hat Red Hat OpenShift Container Platform 4.18 1785278569
  • Red Hat Red Hat OpenShift Container Platform 4.19 1783718157
  • Red Hat Red Hat OpenShift Container Platform 4.20 1782911711, 1784724699
  • Red Hat Red Hat OpenShift Container Platform 4.21 1782308675, 1784713741
  • Red Hat Red Hat OpenShift Container Platform 4.22 1782224390, 1784721581
  • Red Hat Red Hat OpenShift Dev Spaces 3.30 1787762793
  • Red Hat Red Hat OpenShift Service Mesh 2.6 1780907585, 1780916536
  • Red Hat Red Hat OpenShift Service Mesh 3.0 1780470245, 1780916345
  • Red Hat Red Hat OpenShift Service Mesh 3.1 1780470706, 1780916478
  • Red Hat Red Hat OpenShift Service Mesh 3.2 1780470003, 1780916392
  • Red Hat Red Hat OpenShift Service Mesh 3.3 1780997382, 1780997438
  • Red Hat Red Hat Quay 3.10 1782487717
  • Red Hat Red Hat Quay 3.12 1781937357
  • Red Hat Red Hat Quay 3.15 1784351966
  • Red Hat Red Hat Quay 3.16 1783955846
  • Red Hat Red Hat Quay 3.9 1781878070
  • Red Hat Red Hat Satellite 6.18 1781032495
  • node-shell-quote Debian 12 1.7.4+~1.7.1-1+deb12u1
  • node-shell-quote Debian 13 1.7.4+~1.7.1-1+deb13u1
  • node-shell-quote Debian 14 1.8.4+~1.7.5-1

debian advisories DEBIAN-CVE-2026-9277

  • node-shell-quote Ubuntu 24.04 LTS 1.7.4+~1.7.1-1ubuntu0.24.04.1
  • node-shell-quote Ubuntu 25.10 1.7.4+~1.7.1-1ubuntu0.25.10.1
  • node-shell-quote Ubuntu Pro 18.04 LTS 1.6.1+20160617-git72fb5a8ce29b-1ubuntu0.1~esm1
  • node-shell-quote Ubuntu Pro 22.04 LTS 1.7.3+~1.7.1-1ubuntu0.1~esm1
  • node-shell-quote Ubuntu Pro 26.04 LTS 1.8.3+~1.7.5-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-9277

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • agama-web-ui openSUSE Tumbleweed 21+360.16caae772-44.1
  • agama-web-ui openSUSE Leap 16.0 17+612.d8bf69336-160000.11.1
  • python-pytest-html openSUSE Tumbleweed 4.2.0-2.1

opensuse advisories openSUSE-SU-2026:10979-1openSUSE-SU-2026:20919-1openSUSE-SU-2026:10861-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-9277 updated cvss 8.1

shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators

  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git
    affected: no fix planned “Will not fix”
  • Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-bootc-rhel10
    affected: no fix available
  • Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 shell-quote
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift4/ose-agent-installer-ui, openshift5/ose-agent-installer-ui-rhel9
    affected: no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-rhel9 1782841925, cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1782844225, cluster-observability-operator/monitoring-console-plugin-pf6-rhel9 1782839658, +6 more
    fixed: vendor fix RHSA-2026:34342
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-openshift-console-plugin-rhel9 4.2.0-10
    fixed: vendor fix RHSA-2026:28010
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1785854226
    fixed: vendor fix RHSA-2026:50850
show 28 more
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/kubevirt-console-plugin-rhel9 1793395171
    fixed: vendor fix RHSA-2026:93951
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1782761244
    fixed: vendor fix RHSA-2026:33574
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1783448184
    fixed: vendor fix RHSA-2026:36754
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1782166952
    fixed: vendor fix RHSA-2026:29197
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532
    fixed: vendor fix RHSA-2026:41928
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-console 1790102793
    fixed: vendor fix RHSA-2026:70647
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-console 1788900680
    fixed: vendor fix RHSA-2026:65840
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console 1788218669
    fixed: vendor fix RHSA-2026:62410
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-console 1787028559
    fixed: vendor fix RHSA-2026:56912
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-console-rhel9 1787054159
    fixed: vendor fix RHSA-2026:56854
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-console-rhel9 1787631382
    fixed: vendor fix RHSA-2026:60023
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-console-rhel9 1785278569
    fixed: vendor fix RHSA-2026:48699
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-console-rhel9 1783718157
    fixed: vendor fix RHSA-2026:40765
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-console-rhel9 1782911711, openshift4/ose-agent-installer-ui-rhel9 1784724699
    fixed: vendor fix RHSA-2026:44263
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-console-rhel9 1782308675, openshift4/ose-agent-installer-ui-rhel9 1784713741
    fixed: vendor fix RHSA-2026:44267
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-console-rhel9 1782224390, openshift4/ose-agent-installer-ui-rhel9 1784721581
    fixed: vendor fix RHSA-2026:44237
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1787762793
    fixed: vendor fix RHSA-2026:62260
  • Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh/kiali-rhel8 1780916536, openshift-service-mesh/kiali-ossmc-rhel8 1780907585
    fixed: vendor fix RHSA-2026:26072
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1780916345, openshift-service-mesh/kiali-ossmc-rhel9 1780470245
    fixed: vendor fix RHSA-2026:26080
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1780916478, openshift-service-mesh/kiali-ossmc-rhel9 1780470706
    fixed: vendor fix RHSA-2026:26077
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1780916392, openshift-service-mesh/kiali-ossmc-rhel9 1780470003
    fixed: vendor fix RHSA-2026:26079
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1780997438, openshift-service-mesh/kiali-ossmc-rhel9 1780997382
    fixed: vendor fix RHSA-2026:26090
  • Red Hat Quay 3.9 quay/quay-rhel8 1781878070
    fixed: vendor fix RHSA-2026:28571
  • Red Hat Quay 3.10 quay/quay-rhel8 1782487717
    fixed: vendor fix RHSA-2026:33683
  • Red Hat Quay 3.12 quay/quay-rhel8 1781937357
    fixed: vendor fix RHSA-2026:30076
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1784351966
    fixed: vendor fix RHSA-2026:42796
  • Red Hat Quay 3.16 quay/quay-rhel9 1783955846
    fixed: vendor fix RHSA-2026:41066

2 more fixed, 40 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm shell-quote
>=1.1.0, <1.8.4
1.8.4

Affected products

  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Red Hat Ansible Automation Platform 2.1
  • Red Hat Red Hat Developer Hub 1.10
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat OpenShift Dev Spaces 3.30
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat OpenShift Service Mesh 3.3
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Node HealthCheck Operator
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat Build of Podman Desktop
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Trusted Artifact Signer

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.