163 matches found
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
DEBIAN-CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
UBUNTU-CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
shell-quote's "quote" function emits a " comment " token as "" followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
The shell-quote library is vulnerable to command injection due to how the quote() function handles { comment } tokens. When a comment token is emitted as #, it comments out the rest of the shell line, potentially neutralizing the opening quote of subsequent string tokens. If a later string contai...
CLEANSTART-2026-XS33213 shell-quote prior to 1
Security vulnerability affects the argo-workflows package. shell-quote prior to 1...
CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`
Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...
PT-2026-102445
Name of the Vulnerable Software and Affected Versions shell-quote versions prior to 1.11.0 Description The quote function emits a comment token starting with , which comments out the remainder of the shell line, including opening quotes of subsequent string tokens. If a subsequent string contains...
CVE-2026-102422: Improper Neutralization of Special Elements used in an OS Command
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling
A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...
shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling
A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...
Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer
Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...
ROOT-APP-NPM-CVE-2026-9277 CVE-2026-9277 in shell-quote - Patched by Root
Root has patched CVE-2026-9277 in the shell-quote package for Root:npm. Multiple fixed versions available...