Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-22T13:22:38 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-78

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.

Cryostat 4 Affected cryostat-openshift-console-plugin-npm Cryostat 4 Affected shell-quote Gatekeeper 3 Not affected gatekeeper/gatekeeper-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Node HealthCheck Operator Not affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Not affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Not affected workload-availability/node-healthcheck-rhel9-operator OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-hub-ui-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-hub-ui-rhel9 OpenShift Service Mesh 2 Affected openshift-service-mesh/kiali-ossmc-rhel8 OpenShift Service Mesh 2 Affected openshift-service-mesh/kiali-rhel8 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-operator-bundle OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9-operator Red Hat AMQ Broker 7 Affected shell-quote Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Not affected automation-eda-controller Red Hat Ansible Automation Platform 2 Affected automation-gateway Red Hat Ansible Automation Platform 2 Affected automation-platform-ui Red Hat build of Apache Camel - HawtIO 4 Not affected shell-quote Red Hat Build of Podman Desktop Will not fix rh-podman-desktop.git Red Hat Build of Podman Desktop - Tech Preview Affected rhdesktop/rh-podman-desktop-ext-bootc-rhel10 Red Hat Data Grid 8 Not affected shell-quote Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 Affected discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 10 Not affected goose Red Hat Enterprise Linux 8 Affected grafana Red Hat Enterprise Linux 8 Not affected pcs Red Hat Enterprise Linux 9 Not affected goose Red Hat Enterprise Linux 9 Will not fix grafana Red Hat Enterprise Linux 9 Not affected pcs Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 Will not fix shell-quote Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-dashboard-rhel8 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console-rhel9 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Satellite 6 Affected satellite/iop-vulnerability-frontend-rhel9 Red Hat Trusted Artifact Signer Not affected rhtas/rekor-search-ui-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal https://www.cve.org/CVERecord?id=CVE-2026-9277 https://nvd.nist.gov/vuln/detail/CVE-2026-9277 https://github.com/ljharb/shell-quote https://github.com/ljharb/shell-quote/commit/1518179 https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p https://www.npmjs.com/package/shell-quote