CVE-2026-9277: shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Security readout for executives and security teams

A widely used JavaScript helper library called shell-quote had a flaw that let attackers sneak a hidden second command into text that applications hand to the operating system. If your app passes untrusted input through this library to build shell commands, an attacker could run their own commands on the server. Red Hat has shipped patched packages across many products. Node.js and JavaScript applications that use shell-quote to build shell commands from data influenced by users, HTTP requests, environment lookups, or file contents. Exposure is highest in build tools, CI pipelines, serverless handlers, developer tooling, and container images that invoke shells with library-generated strings. Red Hat errata indicate broad downstream inclusion across their product portfolio. Treat as urgent patching within standard critical-severity SLAs. The CVSS 9.2 rating and Red Hat's broad errata suggest meaningful footprint across Node.js applications and Red Hat-based systems. No confirmed active exploitation, but the flaw is simple, publicly documented, and enables command execution, so prioritize inventory and patching this sprint. Mitigation focus: Upgrade shell-quote to the patched release referenced by GHSA-w7jw-789q-3m8p in all direct and transitive dependencies.; Apply the relevant Red Hat RHSA updates (for example RHSA-2026:28010 and later) on affected RHEL and layered products.; Audit code that passes user input into `quote()` or `parse(cmd, envFn)` and constrain envFn return shapes..

Prepared

Jul 11, 2026, 06:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.