CVE-2026-9277

shell-quote's "quote" function did not validate object-token inputs against the operator model used by "parse". The ".op" field was backslash-escaped character by character using "/./g", which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in ".op" therefo...