{"cve":"CVE-2026-9277","nvd":{"published":"2026-05-22T14:16:30.330","modified":"2026-09-14T13:19:33.133","status":"Deferred","description":"shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.2},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-77","CWE-78"],"references":["https://github.com/ljharb/shell-quote","https://github.com/ljharb/shell-quote/commit/1518179","https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p","https://www.npmjs.com/package/shell-quote","http://www.openwall.com/lists/oss-security/2026/05/23/2"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-9277","score":0.00793,"percentile":0.56374,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w7jw-789q-3m8p","url":"https://osv.dev/vulnerability/GHSA-w7jw-789q-3m8p","summary":"shell-quote quote() does not escape newlines in object .op values","modified":"2026-09-10T03:50:50.749716623Z","packages":[{"ecosystem":"npm","name":"shell-quote","purl":"pkg:npm/shell-quote","ranges":[">=1.1.0 <1.8.4"],"fixed":["1.8.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}