CVE-2026-9277 Overview
CVE-2026-9277 is a command injection vulnerability [CWE-77] in the shell-quote npm package. The quote() function fails to validate object-token inputs against the operator model used by parse(). The per-character escape regex /(.)/g does not match line terminators in JavaScript, so newline characters in the .op field pass through unescaped. POSIX shells treat a literal newline as a command separator, allowing any content after the newline to execute as a second shell command.
Critical Impact
Attacker-controlled .op values reach a shell unescaped, enabling arbitrary command execution in any application that passes external input to shell-quote.
Affected Products
- shell-quote npm package (versions prior to the fixed release)
- Node.js applications consuming quote() with externally influenced object tokens
- Node.js applications calling parse(cmd, envFn) where envFn returns attacker-influenced object tokens
Discovery Timeline
- 2026-05-22 - CVE-2026-9277 published to the National Vulnerability Database (NVD)
- 2026-05-23 - Disclosure posted to the Openwall OSS-Security mailing list
- 2026-05-23 - Last updated in the NVD database
Technical Details for CVE-2026-9277
Vulnerability Analysis
The shell-quote library converts JavaScript values into shell-safe strings. When quote() receives an object token, it escapes the .op field character by character using the regular expression /(.)/g. In JavaScript, the . metacharacter does not match line terminators including \n, \r, U+2028, and U+2029. These characters bypass the escape routine entirely and reach the output string verbatim.
The resulting string is intended to be safe for direct execution by a POSIX shell. POSIX shells interpret a literal newline as a command separator equivalent to ;. An attacker who controls the .op value can append a newline followed by arbitrary shell commands, producing a second command that the shell executes with the privileges of the calling process.
Root Cause
The root cause is missing structural validation of object-token inputs. The quote() function trusted the shape of objects passed to it and relied on character-class escaping rather than enforcing an allowlist for the .op field. The library's own parse() function uses a strict control-operator model that quote() did not mirror, creating an asymmetry between input parsing and output generation.
Attack Vector
The vulnerability is reachable through two documented API surfaces. First, direct construction of { op: '...\n...' } from external input passed to quote(). Second, invocation of parse(cmd, envFn) when the supplied envFn callback returns object tokens whose .op value is attacker-influenced. Any web service, CLI wrapper, or build tool that funnels untrusted data into either path is vulnerable to remote command injection.
The vulnerable code path manifests in the per-character escape applied to the .op field. See the GitHub Security Advisory GHSA-w7jw-789q-3m8p and the fix commit for technical details.
Detection Methods for CVE-2026-9277
Indicators of Compromise
- Unexpected child process creation from Node.js parent processes that consume the shell-quote package
- Shell command strings in process telemetry containing embedded newline (\n), carriage return (\r), U+2028, or U+2029 characters
- Outbound network connections initiated by shells spawned from web-application backends shortly after request handling
Detection Strategies
- Inventory Node.js dependencies and flag any project resolving shell-quote to a pre-fix version using npm ls shell-quote or software composition analysis tooling
- Inspect application code for calls to quote() and parse(cmd, envFn) where inputs derive from HTTP requests, message queues, or user-supplied configuration
- Add runtime checks or wrappers that reject object tokens containing line terminator characters in .op, pattern, or comment fields
Monitoring Recommendations
- Monitor for child_process.exec and spawn invocations originating from Node.js services and correlate command strings against expected templates
- Alert on shell processes that exhibit lineage from web-facing Node.js services and execute reconnaissance binaries such as id, uname, curl, or wget
- Enable centralized logging of process execution telemetry for ingestion into your SIEM or data lake for retrospective hunting
How to Mitigate CVE-2026-9277
Immediate Actions Required
- Upgrade shell-quote to the fixed release that introduces strict shape validation for object tokens
- Audit application code for any direct construction of object tokens from untrusted input and remove or sanitize those paths
- Restart Node.js processes after updating to ensure the patched module is loaded into memory
Patch Information
The maintainer fixed the issue by replacing the per-character escape with strict shape validation. The .op field must match the parser's control-operator allowlist. The { op: 'glob', pattern } form validates pattern and forbids line terminators. The { comment } form validates comment and forbids line terminators. Any other object shape throws TypeError. Refer to the fix commit and the npm package page for the patched version.
Workarounds
- Reject or sanitize line terminator characters (\n, \r, U+2028, U+2029) in any input that may reach shell-quote before invoking quote() or parse()
- Replace direct shell invocation with child_process.execFile or spawn using argument arrays, avoiding shell interpretation entirely
- Apply allowlist validation on the .op, pattern, and comment fields of any object tokens constructed from external data
# Configuration example
npm update shell-quote
npm ls shell-quote
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
