CVE-2026-102422

The shell-quote library is vulnerable to command injection due to how the quote() function handles { comment } tokens. When a comment token is emitted as #, it comments out the rest of the shell line, potentially neutralizing the opening quote of subsequent string tokens. If a later string contai...

CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

CVE-2026-102422

shell-quote's "quote" function emits a " comment " token as "" followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the...

CLEANSTART-2026-XS33213 shell-quote prior to 1

Security vulnerability affects the argo-workflows package. shell-quote prior to 1...

CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...

PT-2026-102608

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-102686

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by...

CVE-2026-102809: Memory Allocation with Excessive Size Value

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

Amazon Linux 2 : environment-modules (ALAS-2026-3942)

The version of environment-modules installed on the remote host is prior to 3.2.10-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3942 advisory. modulecomgenwordsandfiles fed untrusted text module names readoff disk, LOADEDMODULES, MODULEPATH straight into compg...

PT-2026-102812

Name of the Vulnerable Software and Affected Versions simple-git versions 3.15.0 through 4.0.0 Description The default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. This allows an attacker to execute arbitrary shell commands with the operating-system...

PT-2026-102778

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

PT-2026-108575

Security vulnerability affects the argo-workflows package. shell-quote prior to 1...

CVE-2026-102422

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

Amazon Linux 2023 : environment-modules, environment-modules-compat (ALAS2023-2026-3135)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3135 advisory. modulecomgenwordsandfiles fed untrusted text module names readoff disk, LOADEDMODULES, MODULEPATH straight into compgen -W, whichperforms a full unquoted-word expansion on its wordlist --...

Important: environment-modules

Issue Overview: modulecomgenwordsandfiles fed untrusted text module names read off disk, LOADEDMODULES, MODULEPATH straight into compgen -W, which performs a full unquoted-word expansion on its wordlist -- including command substitution -- as a normal, documented part of its behavior. A module...

PT-2026-102445

Name of the Vulnerable Software and Affected Versions shell-quote versions prior to 1.11.0 Description The quote function emits a comment token starting with , which comments out the remainder of the shell line, including opening quotes of subsequent string tokens. If a subsequent string contains...

CVE-2026-102422: Improper Neutralization of Special Elements used in an OS Command

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

CVE-2026-18747 Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...

CVE-2026-18747

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rxctxt-nb-len -= 2U; in mcumgrserialprocessfrag subsys/mgmt/mcumgr/transport/src/serialutil.c. mcumgrserialextractlen accepted a...