Input Validation Flaw in shell-quote Affects JavaScript Applications

CVE-2026-9277

What is CVE-2026-9277?

The shell-quote library contains an input validation flaw in its quote() function, which fails to properly validate object-token inputs against the expected operator model of its parse() function. Specifically, the .op field can remain unescaped for line terminators due to the current escaping method. This allows attackers to insert newlines into commands, which are interpreted by POSIX shells as command separators, leading to the execution of unintended commands. This vulnerability can be exploited through direct input of object tokens or by manipulating the environment for the parse(cmd, envFn) function. The issue has been addressed by implementing strict shape validation for the .op field, ensuring compliance with a predefined allowlist and preventing line terminators from causing command injection vulnerabilities.

References