Vulnary
← back to the feed
Critical· 9.2official fix available

CVE-2026-9277

The shell-quote library’s quote() function fails to escape line terminators in operator tokens, allowing attackers to inject newline characters that become separate shell commands. This flaw can lead to arbitrary command execution when the library processes user‑supplied input.

publishedMay 22, 2026
last modifiedAug 3, 2026
sourcesNVD
severity · cvss
9.2
critical · how bad it is
exploitation · epss
<1%
55th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 18, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Node.js developers using the shell-quote library (JavaScript). No specific product versions are listed.

02

Real-world impact

An attacker can inject a newline into an operator token, causing the shell to treat the following text as a new command and execute it. This results in remote code execution on the affected system.

03

Why this severity

The CVSS score of 9.2 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, combined with its network‑reachable nature, low attack complexity, no required privileges, and no user interaction.

04

What to do about it

official fix available
recommended steps
  1. 01Upgrade the shell-quote library to a version that includes the fix.

NVD description indicates the vulnerability was fixed by updating the library

05

Timeline

  1. May 22, 2026 · May 22, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 19, 2026 · 17d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Aug 3, 2026 · 1d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsPresent
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
CVE-2026-9277: The shell-quote library’s quote() function fails to escape line termin · Vulnary