CVE-2026-9277

CVE-2026-9277 - Shell-Quote Command Injection Exploit A specialized Proof of Concept PoC exploit script designed to verify and demonstrate CVE-2026-9277 —a structural Command Injection vulnerability found in legacy versions of the shell-quote library = 1.8.3. The scanner performs deep structural...

CVE-2026-22226

CVE-2026-22226 Proof of Concept for CVE-2026-22226 Authenticated LAN-side OS Command Injection in the VPN Client of TP-Link Archer Wi-Fi routers Vulnerability brief The VPN Client controller stores the user-controlled entry description des in the UCI configuration with a weak validation regex. Wh...

CLEANSTART-2026-GD45765 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

CVE-2026-9277 affects multiple packages. shell-quote's quote function did not validate object-token inputs against the operator model used by parse. See references for individual vulnerability details...

CLSA-2026-1792163710 TuxCare security update for shell-quote (2 CVEs)

TuxCare rebuilt shell-quote to address 2 CVEs. Fixed in 1.8.2-tuxcare.1...

PT-2026-124905

TuxCare rebuilt shell-quote to address 2 CVEs. Fixed in 1.8.2-tuxcare.1...

Astra Linux – Vulnerability in Less

Closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE...

CLEANSTART-2026-SW67186 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token

CVE-2026-102422 affects multiple packages. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. See references for individual vulnerability details...

ROOT-APP-NPM-CVE-2026-102422 CVE-2026-102422 in shell-quote - Patched by Root

Root has patched CVE-2026-102422 in the shell-quote package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-VG90547 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token

Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...

PT-2026-117880

Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...

CLSA-2026-1791584881 TuxCare security update for shell-quote (1 CVE)

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.2...

CVE-2026-102422

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

PT-2026-117930

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.2...

shell-quote npm Code Execution

The vulnerability of the quote function in the shell-quote npm package is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CLSA-2026-1791359284 TuxCare security update for shell-quote (1 CVE)

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.1...

Exploit for CVE-2026-102422

CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...

PT-2026-116388

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.1...

PT-2026-107482

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell quote nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to...

[SECURITY] [DSA 6548-1] node-shell-quote security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2026 https://www.debian.org/security/faq -...

GHSA-PQG4-J6R4-53MV shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...