# CVE-2026-9277

## Summary

- **CVE ID:** CVE-2026-9277
- **Severity:** CRITICAL
- **CVSS Score:** 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-78, CWE-77
- **Published:** May 22, 2026
- **Last Modified:** Sep 14, 2026

## Description

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

## Affected Products

- shell-quote (1.1.0)

## References

- [CNA](https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p)
- [CNA](https://github.com/ljharb/shell-quote/commit/1518179)
- [CNA](https://github.com/ljharb/shell-quote)
- [CNA](https://www.npmjs.com/package/shell-quote)
- [CVE](http://www.openwall.com/lists/oss-security/2026/05/23/2)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-9277)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2480741)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28010)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26234)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29197)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26072)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26080)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26077)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26079)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26090)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:30076)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28571)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26225)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33574)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29834)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29795)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33683)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34342)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34791)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36754)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41066)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41928)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42796)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40765)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44267)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44263)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44237)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50850)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:48699)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56912)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56854)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:62260)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60023)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:62410)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.85%
- **EPSS Percentile:** 56.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._