Read the docs
TI-2026-65392 Aliases CVE-2026-102422GHSA-pqg4-j6r4-53mv

shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00378 31st percentileScored 2026-11-07
Fix Partial shell-quote: 1.11.0shell-quote (npm): 1.11.0Red Hat: 6 advisoriesRed Hat: 2 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—shell-quote1.8.4 to before 1.11.01.11.0Patch availableCNA
—shell-quote (npm)1.8.4 to before 1.11.01.11.0Patch availableGHSA-pqg4-j6r4-53mv
  • shell-quote Vendor— Affected 1.8.4 to before 1.11.0 Fixed in 1.11.0 Patch available CNA
  • shell-quote (npm) Vendor— Affected 1.8.4 to before 1.11.0 Fixed in 1.11.0 Patch available GHSA-pqg4-j6r4-53mv

Remediation

  • Fix · CNA shell-quote Fixed in 1.11.0
  • Fix · GHSA-pqg4-j6r4-53mv shell-quote (npm) Fixed in 1.11.0 Advisory →

Red Hat 6 advisories

  • RHSA-2026:92136 Released 2026-10-28 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:91967 Released 2026-10-28 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:72750 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.3-0.2.hum1@aarch64, prometheus3.13-3.13.3-0.2.hum1@src, prometheus3.13-3.13.3-0.2.hum1@x86_64
Show 3 more Red Hat advisories
  • RHSA-2026:72507 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.8.hum1@aarch64, grafana13.2-13.2.1-0.8.hum1@src, grafana13.2-13.2.1-0.8.hum1@x86_64
  • RHSA-2026:72498 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.6-0.4.hum1@aarch64, grafana13.1-13.1.6-0.4.hum1@src, grafana13.1-13.1.6-0.4.hum1@x86_64
  • RHSA-2026:69544 Released 2026-09-21 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images jaeger-2.20.0-0.11.hum1@aarch64, jaeger-2.20.0-0.11.hum1@src, jaeger-2.20.0-0.11.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Secrets Management Console for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Self-service automation portal 2AffectedNo fix yet
Red Hat Discovery 2Fixed RHSA-2026:91967, RHSA-2026:92136
Red Hat Hardened ImagesFixed RHSA-2026:69544, RHSA-2026:72498, RHSA-2026:72507, RHSA-2026:72750
Not affected: 19 products
  • Cryostat 4
  • Node HealthCheck Operator
  • OpenShift Service Mesh 3
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Podman Desktop
  • Red Hat Connectivity Link 1
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Fuse 7
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat Quay 3
  • Red Hat Trusted Artifact Signer
  • Red Hat build of Apache Camel - HawtIO 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102422
  2. 2026-10-06 Alias added: GHSA-pqg4-j6r4-53mv
  3. 2026-10-06 Fix available: npm/[email protected] · GHSA-pqg4-j6r4-53mv
  4. 2026-10-06 CVSS score added · GHSA-pqg4-j6r4-53mv
  5. 2026-10-06 Weakness changed · GHSA-pqg4-j6r4-53mv
  6. 2026-10-06 4 new references · GHSA-pqg4-j6r4-53mv
  7. 2026-10-09 Affected versions changed · Red Hat
  8. 2026-10-09 CVSS score added · Red Hat
  9. 2026-10-10 Fix available: Red Hat Hardened Images · Red Hat
  10. 2026-10-10 Fix available: RHSA-2026:69544 · Red Hat
  11. 2026-10-10 Fix available: RHSA-2026:72507 · Red Hat
  12. 2026-10-10 Fix available: RHSA-2026:72498 · Red Hat
  13. 2026-10-10 Fix available: RHSA-2026:72750 · Red Hat
  14. 2026-10-16 Affected versions changed · Red Hat
  15. 2026-10-20 Affected versions changed · Red Hat
  16. 2026-10-24 Affected versions changed · Red Hat
  17. 2026-10-27 Affected versions changed · Red Hat
  18. 2026-10-30 Fix available: RHSA-2026:91967 · Red Hat
  19. 2026-10-30 Fix available: RHSA-2026:92136 · Red Hat
  20. 2026-10-30 Fix available: Red Hat Discovery 2 · Red Hat
  21. 2026-10-30 Affected versions changed · Red Hat
  22. 2026-11-04 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences