shell-quote CVE-2026-9277

shell-quote's quote() function did not validate object-token inputs against the operator model used by parse(). The .op field was backslash-escaped character by character using /(.)/g, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in .op therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of { op: '...\n...' } from external input, and (2) via parse(cmd, envFn) when envFn returns object tokens whose .op is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: .op must match the parser's control-operator allowlist; { op: 'glob', pattern } validates pattern and forbids line terminators; { comment } validates comment and forbids line terminators; any other object shape throws TypeError.

The affected component is the npm package shell-quote (maintained by ljharb), versions >= 1.1.0 through <= 1.8.3, fixed in 1.8.4 (package npm/shell-quote). Distribution rebuilds are also affected: Red Hat has published errata RHSA-2026:26072, 26077, 26079, 26080, 26090, 26225, and 26234 covering products that bundle the library. The vendor advisory is GHSA-w7jw-789q-3m8p (https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p), with additional references at https://www.npmjs.com/package/shell-quote, NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-9277), VulDB (https://vuldb.com/vuln/365199), ENISA EUVD EUVD-2026-31440, and the oss-security post at http://www.openwall.com/lists/oss-security/2026/05/23/2.