CVE-2026-102422High· 8.1▾ MidnightPoC availableshell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
1 GitHub repo
shell-quote's quote() function emits a { comment } token as # followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#']) runs id in sh, bash, dash, ksh and zsh. parse() emits a comment token for a # in the middle of a word (for example http://example.com/#frag), so callers that combine parse() output with another untrusted string, such as quote(parse(untrustedCommand).concat(untrustedArg)), are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: quote() throws a TypeError when a string after a { comment } token contains a line terminator.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
shell-quote >= 1.8.4, < 1.11.0Patched in:
shell-quote 1.11.0Source: https://github.com/advisories/GHSA-pqg4-j6r4-53mv
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9277High· 8.1shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`
CVE-2021-23337High· 7.2Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2021-32751High· 7.5Gradle is a build tool with a focus on build automation
CVE-2025-14328High· 8.8Privilege escalation in the Netmonitor component
CVE-2024-53899High· 7.8virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)
CVE-2018-11138Critical· 9.8The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.