CVE-2026-102422
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
quote() emits a { comment } token as # followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input:
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- EPSS
- 0.38% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- shell-quote (npm) >= 1.8.4, < 1.11.0, fixed in 1.11.0 · GHSA-pqg4-j6r4-53mv