CVE-2026-9277 shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
Attackers can execute arbitrary commands by injecting line terminators into object tokens passed to the shell-quote library's quote function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9277?
CVE-2026-9277 is a critical command injection vulnerability in shell-quote, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.
Which versions are affected by CVE-2026-9277?
2 open source packages ship an affected version, including shell-quote.
| Package | Affected | Fixed in |
|---|---|---|
shell-quote npm | From 1.1.0 | 1.8.4 |
shell-quote npm | From 1.1.0 | 1.8.4 |
Linux distribution packages (1)
python-pytest-html openSUSE:Tumbleweed | All versions | 4.2.0-2.1 |
How do I fix CVE-2026-9277?
Upgrade shell-quote to 1.8.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-9277 being exploited?
There is no known exploitation of CVE-2026-9277 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-GD45765, CLEANSTART-2026-GJ43492, CLEANSTART-2026-JC29454, CLSA-2026-1783558964, CLSA-2026-1791359284, DEBIAN-CVE-2026-9277 and 16 more.