shell-quote: Improper Neutralization of Special Elements used in a Command

What to do

1. Update shell-quote to 1.8.4 or a later version.
2. Read the advisory on github.com for workarounds and exact fixed builds.
3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 24 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

HighSuccess depends on conditions outside the attacker's control.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Neutralization of Special Elements used in a Command

Timeline

1. May 22, 2026CVE record published.
2. May 22, 2026CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
3. September 14, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in shell-quote

• 8.1 High severity

  shell-quote: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-102422Sep 29, 2026Shell-quote

Recent Improper Neutralization of Special Elements used in a Command vulnerabilities

• 7.5 High severity

  Microsoft 365 Copilot: Improper Neutralization of Special Elements used in a Command

  CVE-2026-42827May 22, 2026Microsoft
• 9.3 Critical severity

  Microsoft 365 Copilot for iOS: Improper Neutralization of Special Elements used in a Command

  CVE-2026-41090May 22, 2026Microsoft
• 9.8 Critical severity

  Microsoft Power Pages: Improper Neutralization of Special Elements used in a Command

  CVE-2026-23652May 22, 2026Microsoft
• 8.4 High severity

  ManageEngine ADSelfService Plus: Improper Neutralization of Special Elements used in a Command

  CVE-2026-2740May 21, 2026ZohoEPSS 1.7%
• 9.1 Critical severity

  Control Network Module (CNM): Improper Neutralization of Special Elements used in a Command

  CVE-2026-5433May 21, 2026Honeywell International
• 7.8 High severity

  HP Linux Imaging and Printing Software: Improper Neutralization of Special Elements used in a Command

  CVE-2026-8632May 20, 2026HPEPSS 4.11%

Spotted an error? Tell us.