What is the CVSS score of CVE-2026-9277?

CVE-2026-9277 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-9277?

Yes, a public proof-of-concept exploit is available for CVE-2026-9277. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-9277?

Within 24 hours: Execute `npm audit` across all projects to identify shell-quote ≤1.8.3 dependencies; create inventory prioritizing production applications. Within 7 days: Update shell-quote to version 1.8.4 or later in all codebases; deploy to staging for validation testing. Within 30 days: Complete rollout to production environments, verify no execution failures, and document patch status in asset management records for compliance audit trail.

shell-quote CVE-2026-9277

EUVD-2026-31440 CRITICAL

OS Command Injection (CWE-78)

2026-05-22 harborist

GHSA-w7jw-789q-3m8p

Command Injection

9.2

CVSS 4.0 · Vendor: harborist

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify caller passing object tokens to quote()
Delivery

Inject .op value containing literal newline
Exploit

Newline survives /(.)/g escaping
Execution

quote() output handed to POSIX shell
Persist

Newline parsed as command separator
Impact

Second arbitrary command executes in app context

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a specific calling pattern, not just network reach: the application must (1) pass object tokens to shell-quote's quote() whose .op (or glob pattern/comment) field is attacker-influenced - either via direct construction of { op: '...\n...' } from external/deserialized input, or via parse(cmd, envFn) where envFn returns object tokens sourced from attacker-controlled data - and (2) hand quote()'s output to a POSIX shell (e.g. child_process with shell:true). The injected value must contain a line terminator (\n, \r, U+2028, or U+2029); this is what the per-character /(.)/g escape failed to neutralize. Limiting factors that reduce real-world exposure: applications that only feed plain string tokens (the common usage) are NOT affected, the parser itself only emits ops from a fixed safe control set so parse() of normal strings is not the trigger, and the result must actually be executed by a shell. The CVSS AT:P flag and SSVC Automatable=no both reflect these narrow, non-default preconditions. Affected versions: shell-quote >= 1.1.0 through <= 1.8.3.
Impact	Signals are mixed and should be weighed together rather than read off the 9.2 headline. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC/VI/VA:H) yields critical severity, but the AT:P (attack requirements present) flag is doing important work: exploitation is not against shell-quote in isolation - it requires a downstream caller that feeds object tokens with attacker-influenced .op into quote() and then executes the result via a shell. SSVC reinforces this nuance: Exploitation=none (no observed active exploitation), Automatable=no, but Technical Impact=total (full command execution if reached). EPSS is very low (0.05%, 16th percentile), consistent with the narrow preconditions and lack of a single universally-exploitable entry point. Public PoC exists (confirmed under sh, bash, dash, zsh) and Red Hat has shipped errata, so this is a genuine fix-worthy issue for anyone using the affected calling pattern, but it is closer to a high-impact-conditional-reach issue than a mass-exploitable internet-facing RCE. Not in CISA KEV. Bottom line: prioritize patching where shell-quote output is passed to a shell with any externally-influenced token data; treat as lower urgency where object tokens are never derived from untrusted input.
Exploit ScenarioDerived	A Node.js service deserializes an argument array from an external source (or uses parse() with an envFn that reads attacker-influenced data) and constructs a token like { op: ';\nid' }, which it passes through quote() believing the output is shell-safe. Because the newline is not escaped, when the resulting string is run via child_process.execSync(..., { shell: true }) the shell executes the attacker's id (or any payload) as a separate command. A public PoC for exactly this pattern exists (gist by alon710) and is confirmed across sh, bash, dash, and zsh.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 30, 2026

Shell command injection in the npm shell-quote library (versions >= 1.1.0, <= 1.8.3) lets attacker-influenced object tokens smuggle a literal newline through quote(), turning the supposedly shell-safe output into multiple commands. The .op field of an object token was escaped character-by-character with /(.)/g, which in JavaScript does not match line terminators, so a newline survived unescaped and POSIX shells treat everything after it as a second command. Publicly available exploit code exists and a vendor patch (1.8.4) is released, though EPSS is low (0.05%) and SSVC marks current exploitation as none, indicating opportunity-but-not-yet-widespread risk.

Earlier versions of this analysis (2)

v2 Jun 30, 2026 - 03:30 cvss changed CVSS 9.2

Command injection in the shell-quote Node.js library (CWE-78) lets attacker-influenced object tokens smuggle a literal line terminator through the quote() function, breaking out of intended shell quoting. The per-character escape regex /(.)/g does not match newlines (\n, \r, U+2028, U+2029), so a newline placed in an object token's .op field passes through unescaped; POSIX shells treat that newline as a command separator, executing anything after it as a second command. Publicly available exploit code exists and a vendor patch is available, but it is not in CISA KEV and EPSS is very low (0.05%), consistent with no confirmed in-the-wild exploitation.

v1 May 22, 2026 - 14:00 CVSS 8.1

Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitrary shell commands via unescaped line terminators in the .op field. Affects the quote() API and parse() flows that accept object tokens, with no public exploit identified at time of analysis but a vendor-released upstream fix in commit 1518179. EPSS data was not provided, but the package's massive ecosystem footprint (millions of weekly npm downloads) makes downstream supply-chain exposure substantial.

RemediationAI

Vendor-released patch: upgrade shell-quote to 1.8.4 or later (npm install shell-quote@^1.8.4, then verify transitive dependencies with npm ls shell-quote and refresh lockfiles), as fixed in commit 1518179 and described in advisory GHSA-w7jw-789q-3m8p. For Red Hat-based systems, apply the corresponding errata (RHSA-2026:26072/26077/26079/26080/26090/26225/26234) for any product that bundles the library. If you cannot upgrade immediately, the actionable compensating control is to stop passing object tokens whose .op/pattern/comment fields originate from untrusted input into quote(): sanitize or whitelist .op values against the parser's control-operator allowlist before calling quote(), and reject any token containing line terminators (\n, \r, U+2028, U+2029) - side effect: this duplicates the upstream fix logic and must be maintained in your own code. Where feasible, also avoid handing quote() output to a real shell (use child_process execFile/spawn with an argument array and shell:false), which removes the shell-interpretation step entirely - side effect: features relying on shell syntax (pipes, globbing) stop working. Audit any parse(cmd, envFn) usage where envFn consults an attacker-influenced data source and can return object tokens.

Affected Packages

npm shell-quote fix: 1.8.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

shell-quote is a widely-used JavaScript/Node.js utility that builds shell-safe command strings via quote() and parses them via parse(); it is meant to act as a shell-safety boundary so callers can hand its output to a shell. The flaw (CWE-78, OS Command Injection) stems from quote()'s handling of object tokens - a documented part of the API where tokens can be shapes like { op: ';' }, { op: 'glob', pattern } or { comment }. The .op value was backslash-escaped with the regex /(.)/g, and the dot in JavaScript regex (without the s flag) does not match line terminators \n, \r, U+2028, or U+2029, so any line terminator embedded in .op passed through verbatim. Because sh/bash/dash/zsh interpret a literal newline as a command separator, the unescaped newline ends the intended token and starts a fresh command line. The fix replaces per-character escaping with strict shape validation: .op must match the parser's control-operator allowlist (||, &&, ;;, |&, <(, <<<, >>, >&, <&, &, ;, (, ), |, <, >), glob patterns and comments must contain no line terminators, and any other object shape throws TypeError.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (harborist) PRIMARY 9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 8.1 HIGH

AC:H because exploitation needs a caller feeding attacker-influenced object tokens to quote() then to a shell; PR:N/UI:N as the library imposes no auth, and full command execution gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat 8.1 HIGH

Primary rating from Vendor (harborist).

CVSS VectorVendor: harborist

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 03:31 vuln.today

v3 - CVSS changed

Analysis Updated

Jun 30, 2026 - 03:30 vuln.today

v2 - CVSS changed

Severity Changed

Jun 30, 2026 - 03:24 NVD

HIGH CRITICAL

CVSS changed

Jun 30, 2026 - 03:24 NVD

8.1 (HIGH) 9.2 (CRITICAL)

DescriptionCVE.org

shell-quote's quote() function did not validate object-token inputs against the operator model used by parse(). The .op field was backslash-escaped character by character using /(.)/g, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in .op therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of { op: '...\n...' } from external input, and (2) via parse(cmd, envFn) when envFn returns object tokens whose .op is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: .op must match the parser's control-operator allowlist; { op: 'glob', pattern } validates pattern and forbids line terminators; { comment } validates comment and forbids line terminators; any other object shape throws TypeError.

Executive ViewAI

Why It Matters

The npm shell-quote library (versions 1.1.0-1.8.3) contains a critical remote command execution vulnerability affecting thousands of Node.js applications in your supply chain; while current exploitation remains limited (EPSS 0.1%), publicly available exploit code and the library's widespread use create material risk of system compromise and data breach. Vendor patch 1.8.4 is available and must be deployed across all affected applications urgently.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 84% exploitable

Prevalence

High

extremely popular npm package, deep transitive dependency in Node ecosystems

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Same weakness CWE-78 – OS Command Injection

View all

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

CVE-2018-11138 CRITICAL POC

9.8

CVE-2014-6278 HIGH POC

8.8

CVE-2020-9054 CRITICAL POC

9.8

CVE-2017-6334 HIGH POC

8.8

CVE-2024-50603 CRITICAL POC

10.0

Same technique Command Injection

View all

CVE-2024-21887 CRITICAL POC

9.1

CVE-2016-3081 HIGH POC

8.1

CVE-2012-1823 CRITICAL POC

9.8

CVE-2016-1555 CRITICAL POC

9.8

CVE-2024-55956 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 12	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back