CVE-2026-9277: ljharb shell-quote command injection in quote function

CVE-2026-9277 · Severity: high · CVSS 8.1 · Published 2026-05-22

The shell-quote library, a popular tool for preparing commands to run in a system shell, contains a vulnerability that fails to properly clean certain inputs. An attacker can exploit this by injecting hidden commands using line breaks, which a system shell may then execute as separate, unauthorized instructions. This could lead to full system compromise or unauthorized data access depending on how the library is used in an application.

Technologies: shell-quote (npm). Vendors: npm.

Quick answers

Is CVE-2026-9277 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9277 being exploited in the wild.
How severe is CVE-2026-9277?
High severity, with a CVSS score of 8.1, published 22 May 2026.
Which products and versions are affected?
shell-quote (npm) >= 1.1.0, <= 1.8.3, SEMVER:introduced=1.1.0,fixed=1.8.4.
Is there a fix for CVE-2026-9277?
Yes. shell-quote (npm): upgrade to 1.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9277 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9277?
Check whether you run shell-quote (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shell-quote (npm): upgrade to 1.8.4 or later
    npm install shell-quote@1.8.4

Technical details

A command injection vulnerability exists in shell-quote's `quote()` function due to improper neutralization of line terminators (\n, \r, U+2028, U+2029) within the `.op` field of object tokens. The function used a per-character backslash-escaping regex `/(.)/g` which, in JavaScript, does not match line terminators, allowing them to pass into the output unescaped. Because POSIX shells treat newlines as command separators, an attacker can inject arbitrary commands if the application passes attacker-influenced object tokens to `quote()`. This is reachable via direct construction of object tokens or through the `parse()` function's `envFn` callback. The issue is fixed in version 1.8.4 by implementing strict allowlist validation for the `.op` field and other object shapes.

Affected products

  • ljharb shell-quote >= 1.1.0, <= 1.8.3

Identifiers

  • CVE-2026-9277
  • GHSA-w7jw-789q-3m8p

Timeline

  • 2026-05-09: disclosed: Issue reported to maintainer
  • 2026-05-22: patched: Version 1.8.4 released
  • 2026-05-22: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.