CLEANSTART-2026-SW67186 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token

CVE-2026-102422 affects multiple packages. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. See references for individual vulnerability details...