CVE-2026-9277
1 advisory.
npm/shell-quote CVE-2026-9277: high 8.1, EPSS 0.82%
shell-quote quote() does not escape newlines in object .op values
Action: Upgrade shell-quote to 1.8.4 or later.
npm i shell-quote@1.8.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.1.0 | 1.8.4 | - |
Fixed versions
| 1.8.4 |
Sources
- osv: GHSA-w7jw-789q-3m8p
- https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p
- https://nvd.nist.gov/vuln/detail/CVE-2026-9277
- https://github.com/ljharb/shell-quote/commit/1518179
- https://github.com/ljharb/shell-quote
- https://www.npmjs.com/package/shell-quote
- http://www.openwall.com/lists/oss-security/2026/05/23/2
CVE-2026-9277 · published · modified · JSON