CVE-2026-102422: shell-quote Command Injection via Line Terminator in Comment Token
Summary
CVE-2026-102422: shell-quote: quote() command injection via a line terminator in a token after a { comment } token. Affects shell-quote versions >= 1.8.4, < 1.11.0. Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shell-quote package is a utility in the npm ecosystem that allows developers to safely quote strings for shell commands. It is designed to handle various shell quoting scenarios, ensuring that commands are executed correctly without unintended side effects. However, this package is vulnerable to a command injection issue when a line terminator is present in a token following a comment token, which can lead to serious security risks.
Vulnerability Detail
The vulnerability arises from the way the quote() function processes tokens. When a comment token is present, it comments out the rest of the shell line, including any subsequent string tokens. If a line terminator is included in a string token after a comment, it ends the comment prematurely, allowing the rest of the string to be interpreted as shell input. This can lead to arbitrary command execution if an attacker can control the input. For example, passing a string like 'a\nid;#' to quote() can result in the execution of 'id' when processed by a shell.
How To Fix
Latest published version: 1.12.0 as of 22 Oct 2026
npm install shell-quote@1.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.0
This is the first release that contains the fix.
npm install shell-quote@1.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can drop every token after a comment token before calling quote(). Additionally, ensure that any untrusted strings do not contain line terminators. Here is an example of how to implement this workaround:
const safeTokens = tokens.filter(token => !(typeof token === 'object' && token.comment));
const quotedCommand = quote(safeTokens);
Conclusion
The shell-quote package has a critical vulnerability (CVE-2026-102422) that allows command injection via line terminators in tokens following comment tokens. It is essential to update to version 1.11.0 or later to mitigate this risk. Implementing the suggested workarounds can provide temporary relief until the package is updated.
See every vulnerability recorded for shell-quote →
FAQ
The vulnerability has a CVSS score of 8.1, indicating a critical severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If left unaddressed, this vulnerability could allow attackers to execute arbitrary commands on your system, leading to potential data breaches or system compromise.
Yes, you should update to version 1.11.0 or later to ensure that the vulnerability is patched.
The shell-quote package is used to safely quote strings for shell commands, preventing issues related to command injection and ensuring proper execution of commands.
References
Related vulnerabilities
Recent vulnerabilities recorded for shell-quote.
