42970 matches found
MSC-2026-12399
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-12376
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...
MSC-2026-12338
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...
@ache-lol/cli (>=0.1.97, <=0.1.99), @agent-workshop/adoc (>=0.1.0, <=0.1.3) +101 more potentially affected by CVE-2026-102422 via shell-quote (>=1.8.4, <=1.10.0)
shell-quote NPM version =1.8.4, =0.1.97, =0.1.0, =0.0.13, =14.0.13, =10.6.0, =3.3.0, =2.4.3, =6.0.4, =4.3.0, =1.0.0-beta.0, =4.2.5, =1.1.5, =7.2.3, =8.0.0-beta.1 - @appium/test-support 4.1.5 and more Source cves: CVE-2026-102422 Source advisory: SNYK:JS-SHELLQUOTE-20250993...
Command Injection
Overview org.webjars.npm:shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Command Injection via the quote function when a comment token is followed by a string token containing a line terminator. A comment token emits a -prefixed...
Command Injection
Overview shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Command Injection via the quote function when a comment token is followed by a string token containing a line terminator. A comment token emits a -prefixed string that...
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
DEBIAN-CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
UBUNTU-CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
shell-quote's "quote" function emits a " comment " token as "" followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
@ache-lol/cli (>=0.1.97, <=0.1.99), @agent-workshop/adoc (>=0.1.0, <=0.1.3) +101 more potentially affected by CVE-2026-102422 via shell-quote (>=1.8.4, <=1.10.0)
shell-quote NPM version =1.8.4, =0.1.97, =0.1.0, =0.0.13, =14.0.13, =10.6.0, =3.3.0, =2.4.3, =6.0.4, =4.3.0, =1.0.0-beta.0, =4.2.5, =1.1.5, =7.2.3, =8.0.0-beta.1 - @appium/test-support 4.1.5 and more Source cves: CVE-2026-102422 Source advisory: MEND:CVE-2026-102422...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
The shell-quote library is vulnerable to command injection due to how the quote() function handles { comment } tokens. When a comment token is emitted as #, it comments out the rest of the shell line, potentially neutralizing the opening quote of subsequent string tokens. If a later string contai...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CLEANSTART-2026-XS33213 shell-quote prior to 1
Security vulnerability affects the argo-workflows package. shell-quote prior to 1...
CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`
Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...
CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...
