Skip to content
OpenAdvisories

Package · Ubuntu

node-shell-quote

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-102422 Public exploit

    shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token

    shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string the…

    shell-quote node-shell-quote node-shell-quote Debian Ubuntu npm
  • High 8.1
    CVE-2026-9277 Public exploit

    shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

    shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+202…

    shell-quote node-shell-quote node-shell-quote Debian Ubuntu npm