CVE-2026-9277: shell-quote Package Vulnerability - Shell Command Injection Risk
Summary
CVE-2026-9277: shell-quote quote() does not escape newlines in object .op values. Affects shell-quote versions >= 1.1.0, < 1.8.4. Fixed in 1.8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The shell-quote package is a JavaScript library used for parsing and quoting shell commands. It allows developers to safely construct command strings for execution in shell environments. However, a vulnerability exists in its quote() function, which fails to properly escape newlines in object .op values, leading to potential command injection attacks.
Vulnerability Detail
The vulnerability arises from the shell-quote's quote() function not validating object-token inputs against the operator model used by the parse() function. Specifically, the .op field is backslash-escaped character by character, but this method does not account for line terminators such as \n and \r. As a result, an attacker can craft an object token with a newline character in the .op field, allowing for shell command injection. This can lead to unintended command execution, as POSIX shells treat a literal newline as a command separator. The vulnerability can be exploited through direct construction of object tokens or via the envFn return in the parse() function.
How To Fix
Latest published version: 1.12.0 as of 22 Oct 2026
npm install shell-quote@1.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.4
This is the first release that contains the fix.
npm install shell-quote@1.8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Before upgrading, ensure that any object tokens built from untrusted input validate the .op field against the parser's operator set. Avoid constructing { op } from attacker-controlled strings. Here is an example of a validation check:
const allowedOps = ['||', '&&', ';;', '|&', '<(', '<<<', '>>', '>&', '<&', '&', ';', '(', ')', '|', '<', '>'];
function validateOp(op) {
if (!allowedOps.includes(op)) {
throw new TypeError('Invalid operation');
}
}
Conclusion
The shell-quote package has a critical vulnerability (CVE-2026-9277) that can lead to shell command injection due to improper newline handling in object .op values. It is crucial to update to version 1.8.4 or later to mitigate this risk. Additionally, implementing validation checks on object tokens can help prevent exploitation until an upgrade is possible.
See every vulnerability recorded for shell-quote →
FAQ
CVE-2026-9277 is a vulnerability in the shell-quote package that allows for shell command injection due to improper handling of newlines in object .op values.
An attacker can exploit this vulnerability by crafting an object token with a newline character in the .op field, leading to unintended command execution in the shell.
The potential impacts include unauthorized command execution, which can compromise the security of the application and the underlying system.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
If you cannot upgrade immediately, validate the .op field of any object tokens built from untrusted input to prevent potential injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for shell-quote.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
