137 matches found
CVE-2026-22226
CVE-2026-22226 CVE-2026-22226에 대한 개념 증명 TP-Link Archer Wi-Fi 라우터 VPN 클라이언트의 인증된 LAN 측 OS 명령 삽입 취약점 개요 VPN 클라이언트 컨트롤러는 사용자가 제어하는 항목 설명des을 약한 검증 정규식을 사용하여 UCI 구성에 저장합니다. 나중에 항목을 다시 읽을 때WebUI에서 편집 중, getovpndata는 des를 인용된 셸 명령에 보간하여 추가 소독 없이 os.execute에 전달합니다: -- getovpndata in vpn.lua...
Linux Distros Unpatched Vulnerability : CVE-2026-102422
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any...
CLSA-2026-1790673243 TuxCare security update for shell-quote (1 CVE)
TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.10.0-tuxcare.1...
Command Injection
Overview shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Command Injection via the quote function when a comment token is followed by a string token containing a line terminator. A comment token emits a -prefixed string that...
Command Injection
Overview org.webjars.npm:shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Command Injection via the quote function when a comment token is followed by a string token containing a line terminator. A comment token emits a -prefixed...
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
DEBIAN-CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
UBUNTU-CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
The shell-quote library is vulnerable to command injection due to how the quote() function handles { comment } tokens. When a comment token is emitted as #, it comments out the rest of the shell line, potentially neutralizing the opening quote of subsequent string tokens. If a later string contai...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`
Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-9277
CVE-2026-9277 - Shell-Quote 명령 주입 익스플로잇 레거시 shell-quote 라이브러리= 1.8.3에서 발견된 구조적 명령 주입 취약점인 CVE-2026-9277 을 검증 및 시연하기 위해 설계된 특수 PoCProof of Concept 익스플로잇 스크립트입니다. 이 스캐너는 입력 JSON 페이로드에 대해 깊은 구조적 조작을 수행하여 재귀적 순회를 통해 원격 코드 실행RCE 벡터를 노출하며, 동적 네트워크 기준 타이밍 엔진을 사용하여 오탐을 방지합니다. 주요 기능 재귀적 JSON 순회: 다중 레이어 중첩...
Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer
Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...
Astra Linux – Vulnerability in Less
Closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE...