CVE-2026-9277: shell-quote quote() does not escape newlines in object .op values

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.8%, percentile 57: FIRST’s model estimates a 0.8% chance of exploitation activity in the next 30 days, higher than 57% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes shell-quote (npm) >= 1.1.0, <= 1.8.3, fixed in 1.8.4. Check your lockfile, including transitive dependencies.

What it is

shell-quote's quote() function did not validate object-token inputs against the operator model used by parse(). The .op field was backslash-escaped character by character using /(.)/g, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in .op therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of { op: '...\n...' } from external input, and (2) via parse(cmd, envFn) when envFn returns object tokens whose .op is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: .op must match the parser's control-operator allowlist; { op: 'glob', pattern } validates pattern and forbids line terminators; { comment } validates comment and forbids line terminators; any other object shape throws TypeError.

From the GitHub advisory

Summary

shell-quote's quote() function did not validate object-token inputs against the operator model used by parse(). The .op field was backslash-escaped character by character using /(.)/g, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in .op therefore passed through unescaped into the output; POSIX shells treat a literal \n as a command separator, so any content after it would execute as a second command.

The vulnerable code path is reachable in two ways. Neither requires the parser to misbehave — parse() only emits ops from a fixed control set — but both are documented API surface:

1. Direct construction. A caller builds { op: '...\n...' } from external input (e.g. a deserialized argument array) and passes it to quote(). 2. envFn return. parse(cmd, envFn) is documented to splice the return value of envFn into the result array when it is an object. An attacker-influenced data source consulted by envFn can introduce an object token whose .op reaches quote().

Impact

Weakness type: CWE-78, CWE-77.

Product: shell-quote (npm) · Assigned by: harborist · Published: 2026-05-22

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: present (depends on deployment conditions)
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.82% probability of exploitation activity in the next 30 days; percentile 57.

Timeline

• 2026-05-22 — CVE record published by harborist
• 2026-06-09 — GitHub-reviewed advisory GHSA-w7jw-789q-3m8p published (critical)
• 2026-09-14 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

1. GHSA-w7jw-789q-3m8p github.com
2. Fix commit github.com
3. access.redhat.com access.redhat.com
4. access.redhat.com access.redhat.com
5. access.redhat.com access.redhat.com
6. access.redhat.com access.redhat.com
7. access.redhat.com access.redhat.com
8. access.redhat.com access.redhat.com
9. access.redhat.com access.redhat.com
10. access.redhat.com access.redhat.com
11. access.redhat.com access.redhat.com
12. access.redhat.com access.redhat.com
13. access.redhat.com access.redhat.com
14. access.redhat.com access.redhat.com
15. access.redhat.com access.redhat.com
16. access.redhat.com access.redhat.com
17. access.redhat.com access.redhat.com
18. access.redhat.com access.redhat.com
19. access.redhat.com access.redhat.com
20. access.redhat.com access.redhat.com
21. access.redhat.com access.redhat.com
22. access.redhat.com access.redhat.com
23. access.redhat.com access.redhat.com
24. access.redhat.com access.redhat.com
25. access.redhat.com access.redhat.com
26. access.redhat.com access.redhat.com
27. access.redhat.com access.redhat.com
28. access.redhat.com access.redhat.com
29. access.redhat.com access.redhat.com
30. access.redhat.com access.redhat.com
31. access.redhat.com access.redhat.com
32. access.redhat.com access.redhat.com
33. access.redhat.com access.redhat.com

Vulnerability records

1. GitHub Advisory GHSA-w7jw-789q-3m8p github.com
2. CVE.org record CVE-2026-9277 cve.org
3. NVD entry CVE-2026-9277 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. npmjs.com npmjs.com
3. openwall.com openwall.com
4. access.redhat.com access.redhat.com
5. RHBZ#2480741 bugzilla.redhat.com
6. security.access.redhat.com security.access.redhat.com

Critical npm advisories · Today’s Security Digest