TI-2026-65392 CVE-2026-102422 · GHSA-pqg4-j6r4-53mv
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
Priority MEDIUM 42
shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token.