CVE-2026-102422
Received Received - Intake

Command Injection Risk in shell-quote Library

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: harborist

Description
shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102422
EUVD
EUVD-2026-88629

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ljharb shell-quote From 1.8.4 (inc) to 1.11.0 (exc)
ljharb shell-quote 1.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-102422 is a command injection flaw in the shell-quote npm package. The quote() function incorrectly handles { comment } tokens, which are emitted as shell comments (# followed by text). If a string token after a comment contains a line terminator (like newline), the comment ends prematurely, allowing the rest of the string to be parsed as shell input. This can lead to arbitrary command execution in shells like bash or sh.

Detection Guidance

To detect this vulnerability, check if your system uses shell-quote versions >= 1.8.4 and < 1.11.0. Run: npm list shell-quote or grep shell-quote package.json. If vulnerable, update to version 1.11.0 or later.

Impact Analysis

An attacker could exploit this by providing a malicious string with a line terminator after a { comment } token. When processed by quote(), this could execute unintended commands on your system. The impact includes unauthorized code execution, data theft, or system compromise, depending on the context where shell-quote is used.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately update shell-quote to version 1.11.0 or later using npm update shell-quote. If updating is not possible, avoid passing untrusted strings with line terminators after { comment } tokens to quote(). Validate inputs to reject line terminators in untrusted strings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart