PT-2026-42766 · Npm+2 · Shell-Quote+2
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
shell-quote versions prior to 1.8.4
Description
The
quote() function fails to validate object-token inputs against the operator model used by parse(). Specifically, the .op field is escaped using a regular expression that does not match line terminators such as , r, U+2028, and U+2029. This allows line terminators to pass unescaped into the output. Since POSIX shells treat literal newlines as command separators, any content following the newline is executed as a separate command, leading to command injection. This issue is reachable through the direct construction of { op: '... ...' } from external input or via parse(cmd, envFn) when envFn returns object tokens with an attacker-influenced .op field.Recommendations
Update to version 1.8.4 or later.
As a temporary workaround, restrict external input from influencing the
.op field in object tokens passed to the quote() function or returned by envFn in the parse() function.Exploit
Fix
Command Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Ubuntu
Shell-Quote