shell-quote EUVD-2026-88629

Exploitation requires the downstream application (not shell-quote's defaults) to call quote() with a { comment } token followed by a string that includes attacker-controlled data, or to use the quote(parse(untrustedCommand).concat(untrustedArg)) idiom where parse() emits a mid-word '#' comment token (e.g. from a URL fragment). The attacker must inject a line terminator (\n, \r, U+2028, or U+2029) followed by shell syntax into that later string, and the resulting string must actually be executed by a POSIX-family shell (sh, bash, dash, ksh, zsh). Limiting factors: the flaw is not triggerable against a bare default install - it needs the specific vulnerable calling pattern, so real exposure depends on how each dependent project uses the library; upgrading to shell-quote 1.11.0 makes quote() throw a TypeError in these cases.

This is a genuine command-injection flaw (CWE-78) in shell-quote, a foundational Node.js utility, and the vendor CVSS 4.0 score of 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) reflects the potential for full shell execution. However, the raw score overstates broad real-world risk because the vulnerability is a library defect that is only exploitable when the CALLING application uses a specific, non-default pattern: passing untrusted data through quote() with a { comment } token followed by an untrusted string, or the quote(parse(untrusted).concat(untrustedArg)) idiom. The AT:P (Attack Requirements: Present) metric captures exactly this - exploitation is conditional on how the downstream code is written, not on default library behavior. EPSS is not provided, the CVE is NOT in CISA KEV, and no public standalone exploit is identified (only regression tests ship with the fix), so there is no signal of active or widespread exploitation. Signals are internally consistent: high technical impact but a conditional, developer-dependent trigger. Treat as a real fix-forward priority for any project that constructs shell strings from user input via shell-quote, but not an emergency mass-exploitation event. Note also this is an INCOMPLETE-FIX follow-up to CVE-2026-9277, which only rejected line terminators inside the comment's own text.

An application builds a shell command from user-controlled input using shell-quote's quote(), where a { comment } token is followed by an attacker-influenced string (or uses quote(parse(untrustedCommand).concat(untrustedArg))). The attacker supplies a value containing a line terminator followed by shell code (e.g. 'a\nid;#'); the terminator ends the injected '#' comment and the remainder is parsed and executed by sh/bash/dash/ksh/zsh. No standalone public exploit is identified, but the security advisory's regression tests demonstrate the technique concretely.