Command Injection in shell-quote - CVE-2026-9277

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU138393

Command Injection in shell-quote - CVE-2026-9277

Published: July 20, 2026


Vulnerability identifier: #VU138393
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-9277
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.. A remote attacker can pass specially crafted data to the application and execute arbitrary commands.


Affected software

shell-quote
Debian Linux
Ubuntu
node-shell-quote (Ubuntu package)
node-shell-quote (Debian package)
Red Hat OpenShift Container Platform

How to mitigate CVE-2026-9277

Install updates from vendor's website.

shell-quote - update to 1.8.4
node-shell-quote (Ubuntu package) - addressed in versions 1.6.1+20160617-git72fb5a8ce29b-1ubuntu0.1~esm1, 1.7.3+~1.7.1-1ubuntu0.1~esm1, 1.7.4+~1.7.1-1ubuntu0.24.04.1, 1.7.4+~1.7.1-1ubuntu0.25.10.1, 1.8.3+~1.7.5-1ubuntu0.1~esm1
node-shell-quote (Debian package) - addressed in versions 1.7.4+~1.7.1-1+deb12u1, 1.7.4+~1.7.1-1+deb13u1
Red Hat OpenShift Container Platform - addressed in versions 4.19.39, 4.20.28, 4.20.31, 4.21.22, 4.21.26, 4.22.3

External References

Related Security Bulletins