https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 05:42:52 +0000 https://db.gcve.eu/vuln/cve-2026-102422 <p><strong>Affected:</strong> shell-quote</p> <p>shell-quote&#39;s `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote([&#39;echo&#39;, &#39;ok&#39;, { comment: &#39;x&#39; }, &#39;a\nid;#&#39;])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment&#39;s own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.</p> <p><strong>Affected:</strong> shell-quote</p> <p>shell-quote&#39;s `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote([&#39;echo&#39;, &#39;ok&#39;, { comment: &#39;x&#39; }, &#39;a\nid;#&#39;])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment&#39;s own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.</p> https://db.gcve.eu/vuln/cve-2026-102422 https://db.gcve.eu/vuln/ghsa-pqg4-j6r4-53mv <p><strong>Affected:</strong> npm: shell-quote</p> <p>### Impact</p> <p>`quote()` emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input:</p> <p>```js quote([&#39;echo&#39;, &#39;ok&#39;, { comment: &#39;x&#39; }, &#39;a\nid;#&#39;]); // echo ok #x &#39;a // id;#&#39; ```</p> <p>Passed to `sh`, `bash`, `dash`, `ksh`, or `zsh`, this runs `id`.</p> <p>`parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment&#39;s own text, but not in the tokens after it.</p> <p>Exploitation requires an attacker-controlled string containing a line terminator that follows a `{ comment }` token in the same `quote()` call.</p> <p>### Patches</p> <p>Fixed in v1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator (`\n`, `\r`, U+2028, or U+2029).</p> <p>### Workarounds</p> <p>Drop every token after a `{ comment }` token before calling `quote()`, or reject line terminators in untrusted strings. Separately, do not append other shell text after `quote()` output that contains a comment, since the comment swallows it.</p> <p><strong>Affected:</strong> npm: shell-quote</p> <p>### Impact</p> <p>`quote()` emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input:</p> <p>```js quote([&#39;echo&#39;, &#39;ok&#39;, { comment: &#39;x&#39; }, &#39;a\nid;#&#39;]); // echo ok #x &#39;a // id;#&#39; ```</p> <p>Passed to `sh`, `bash`, `dash`, `ksh`, or `zsh`, this runs `id`.</p> <p>`parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment&#39;s own text, but not in the tokens after it.</p> <p>Exploitation requires an attacker-controlled string containing a line terminator that follows a `{ comment }` token in the same `quote()` call.</p> <p>### Patches</p> <p>Fixed in v1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator (`\n`, `\r`, U+2028, or U+2029).</p> <p>### Workarounds</p> <p>Drop every token after a `{ comment }` token before calling `quote()`, or reject line terminators in untrusted strings. Separately, do not append other shell text after `quote()` output that contains a comment, since the comment swallows it.</p> https://db.gcve.eu/vuln/ghsa-pqg4-j6r4-53mv