{"api_version":"1","generated_at":"2026-07-21T19:30:25+00:00","cve":"CVE-2026-9277","urls":{"html":"https://cve.report/CVE-2026-9277","api":"https://cve.report/api/cve/CVE-2026-9277.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-9277","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-9277"},"summary":{"title":"shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`","description":"shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.","state":"PUBLISHED","assigner":"harborist","published_at":"2026-05-22 14:16:30","updated_at":"2026-07-21 12:19:04"},"problem_types":["CWE-77","CWE-78","CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","CWE-77 CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":[{"version":"4.0","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"version":"3.1","source":"ADP","type":"CVSS","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:34791","name":"https://access.redhat.com/errata/RHSA-2026:34791","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:33683","name":"https://access.redhat.com/errata/RHSA-2026:33683","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","name":"https://access.redhat.com/errata/RHSA-2026:41928","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:26080","name":"https://access.redhat.com/errata/RHSA-2026:26080","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/ljharb/shell-quote/commit/1518179","name":"https://github.com/ljharb/shell-quote/commit/1518179","refsource":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","name":"https://access.redhat.com/errata/RHSA-2026:34342","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","name":"https://access.redhat.com/errata/RHSA-2026:36754","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9277","name":"https://access.redhat.com/security/cve/CVE-2026-9277","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:30076","name":"https://access.redhat.com/errata/RHSA-2026:30076","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:29834","name":"https://access.redhat.com/errata/RHSA-2026:29834","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:28571","name":"https://access.redhat.com/errata/RHSA-2026:28571","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:26077","name":"https://access.redhat.com/errata/RHSA-2026:26077","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:29795","name":"https://access.redhat.com/errata/RHSA-2026:29795","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.npmjs.com/package/shell-quote","name":"https://www.npmjs.com/package/shell-quote","refsource":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:26072","name":"https://access.redhat.com/errata/RHSA-2026:26072","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:26225","name":"https://access.redhat.com/errata/RHSA-2026:26225","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:26090","name":"https://access.redhat.com/errata/RHSA-2026:26090","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/23/2","name":"http://www.openwall.com/lists/oss-security/2026/05/23/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","name":"https://access.redhat.com/errata/RHSA-2026:29197","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:26079","name":"https://access.redhat.com/errata/RHSA-2026:26079","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p","name":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/ljharb/shell-quote","name":"https://github.com/ljharb/shell-quote","refsource":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json","name":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:28010","name":"https://access.redhat.com/errata/RHSA-2026:28010","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","name":"https://access.redhat.com/errata/RHSA-2026:41066","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480741","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2480741","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","name":"https://access.redhat.com/errata/RHSA-2026:26234","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","name":"https://access.redhat.com/errata/RHSA-2026:33574","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9277","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9277","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"ADP","vendor":"Red Hat","product":"Cryostat 4 on RHEL 9","version":"unaffected 4.2.0-10 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782840519 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839981 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839193 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782838753 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839279 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782840539 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782841925 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782844225 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839658 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782838476 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839996 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839494 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Developer Hub 1.10","version":"unaffected 1783448184 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Developer Hub 1.9","version":"unaffected 1781187342 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Developer Hub 1.9","version":"unaffected 1782761244 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Discovery 2","version":"unaffected 1782166952 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Migration Toolkit 1.8","version":"unaffected 1783690532 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","version":"unaffected 1782911711 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","version":"unaffected 1782308675 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","version":"unaffected 1782224390 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 2.6","version":"unaffected 1780907585 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 2.6","version":"unaffected 1780916536 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.0","version":"unaffected 1780470245 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.0","version":"unaffected 1780916345 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.1","version":"unaffected 1780470706 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.1","version":"unaffected 1780916478 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.2","version":"unaffected 1780470003 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.2","version":"unaffected 1780916392 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.3","version":"unaffected 1780997382 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Service Mesh 3.3","version":"unaffected 1780997438 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Quay 3.1","version":"unaffected 1782487717 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Quay 3.12","version":"unaffected 1781937357 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Quay 3.16","version":"unaffected 1783955846 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Quay 3.9","version":"unaffected 1781878070 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Satellite 6.18","version":"unaffected 1781032495 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cryostat 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Gatekeeper 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Node HealthCheck Operator","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Node HealthCheck Operator","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Node HealthCheck Operator","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Lightspeed","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Lightspeed","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Lightspeed","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Pipelines","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Pipelines","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Pipelines","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Pipelines","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Service Mesh 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"OpenShift Service Mesh 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat AMQ Broker 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Build of Podman Desktop - Tech Preview","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Data Grid 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Fuse 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Virtualization 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Trusted Artifact Signer","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Self-service automation portal 2","version":"","platforms":[]}],"timeline":[{"source":"ADP","time":"2026-05-22T14:01:14.427Z","lang":"en","value":"Reported to Red Hat."},{"source":"ADP","time":"2026-05-22T13:22:38.873Z","lang":"en","value":"Made public."}],"solutions":[{"source":"ADP","title":"","value":"RHSA-2026:28010: Cryostat 4 on RHEL 9","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:34342: Cluster Observability Operator 1.5.0","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:36754: Red Hat Developer Hub 1.10","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:33574: Red Hat Developer Hub 1.9","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:26234: Red Hat Developer Hub 1.9","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:29197: Red Hat Discovery 2","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:41928: Red Hat Migration Toolkit 1.8","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:34791: Red Hat OpenShift Container Platform 4.20","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:29834: Red Hat OpenShift Container Platform 4.21","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:29795: Red Hat OpenShift Container Platform 4.22","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:26072: Red Hat OpenShift Service Mesh 2.6","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:26080: Red Hat OpenShift Service Mesh 3.0","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:26077: Red Hat OpenShift Service Mesh 3.1","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:26079: Red Hat OpenShift Service Mesh 3.2","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:26090: Red Hat OpenShift Service Mesh 3.3","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:30076: Red Hat Quay 3.12","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:41066: Red Hat Quay 3.16","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:33683: Red Hat Quay 3.1","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:28571: Red Hat Quay 3.9","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:26225: Red Hat Satellite 6.18","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Akshat Sinha (@akshatgit)","lang":"en"},{"source":"CNA","value":"Jordan Harband (@ljharb)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"9277","cve":"CVE-2026-9277","epss":"0.008480000","percentile":"0.540630000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-9277","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-22T14:17:31.964845Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-05-22T14:17:39.549Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2026-05-23T03:04:40.537Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/05/23/2"}],"title":"CVE Program Container"},{"affected":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cryostat:4::el9"],"defaultStatus":"affected","packageName":"cryostat/cryostat-openshift-console-plugin-rhel9","product":"Cryostat 4 on RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.2.0-10","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782840519","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839193","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/distributed-tracing-console-plugin-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782838753","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/logging-console-plugin-pf4-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839279","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/logging-console-plugin-pf5-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782840539","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/logging-console-plugin-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782841925","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/monitoring-console-plugin-pf5-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782844225","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/monitoring-console-plugin-pf6-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839658","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/monitoring-console-plugin-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782838476","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839996","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhdh:1.10::el9"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783448184","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhdh:1.9::el9"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781187342","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"1782761244","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-ui-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782166952","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhmt:1.8::el8"],"defaultStatus":"affected","packageName":"rhmtc/openshift-migration-ui-rhel8","product":"Red Hat Migration Toolkit 1.8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783690532","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782911711","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782308675","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782224390","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:2.6::el8"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-ossmc-rhel8","product":"Red Hat OpenShift Service Mesh 2.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780907585","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:2.6::el8"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-rhel8","product":"Red Hat OpenShift Service Mesh 2.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780916536","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.0::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-ossmc-rhel9","product":"Red Hat OpenShift Service Mesh 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780470245","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.0::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-rhel9","product":"Red Hat OpenShift Service Mesh 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780916345","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.1::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-ossmc-rhel9","product":"Red Hat OpenShift Service Mesh 3.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780470706","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.1::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-rhel9","product":"Red Hat OpenShift Service Mesh 3.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780916478","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.2::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-ossmc-rhel9","product":"Red Hat OpenShift Service Mesh 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780470003","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.2::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-rhel9","product":"Red Hat OpenShift Service Mesh 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780916392","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.3::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-ossmc-rhel9","product":"Red Hat OpenShift Service Mesh 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780997382","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_mesh:3.3::el9"],"defaultStatus":"affected","packageName":"openshift-service-mesh/kiali-rhel9","product":"Red Hat OpenShift Service Mesh 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780997438","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782487717","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781937357","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783955846","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781878070","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:satellite:6.18::el9"],"defaultStatus":"affected","packageName":"satellite/iop-vulnerability-frontend-rhel9","product":"Red Hat Satellite 6.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781032495","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cryostat:4"],"defaultStatus":"unaffected","packageName":"shell-quote","product":"Cryostat 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:gatekeeper:3"],"defaultStatus":"unaffected","packageName":"gatekeeper/gatekeeper-rhel9","product":"Gatekeeper 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:workload_availability_nhc:0"],"defaultStatus":"unaffected","packageName":"workload-availability/node-healthcheck-must-gather-rhel9","product":"Node HealthCheck Operator","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:workload_availability_nhc:0"],"defaultStatus":"unaffected","packageName":"workload-availability/node-healthcheck-operator-bundle","product":"Node HealthCheck Operator","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:workload_availability_nhc:0"],"defaultStatus":"unaffected","packageName":"workload-availability/node-healthcheck-rhel9-operator","product":"Node HealthCheck Operator","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_lightspeed"],"defaultStatus":"affected","packageName":"openshift-lightspeed/lightspeed-console-plugin-419-rhel9","product":"OpenShift Lightspeed","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_lightspeed"],"defaultStatus":"affected","packageName":"openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9","product":"OpenShift Lightspeed","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_lightspeed"],"defaultStatus":"affected","packageName":"openshift-lightspeed/lightspeed-console-plugin-rhel9","product":"OpenShift Lightspeed","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_pipelines:1"],"defaultStatus":"unaffected","packageName":"openshift-pipelines/pipelines-console-plugin-rhel8","product":"OpenShift Pipelines","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_pipelines:1"],"defaultStatus":"unaffected","packageName":"openshift-pipelines/pipelines-console-plugin-rhel9","product":"OpenShift Pipelines","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_pipelines:1"],"defaultStatus":"affected","packageName":"openshift-pipelines/pipelines-hub-ui-rhel8","product":"OpenShift Pipelines","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_pipelines:1"],"defaultStatus":"affected","packageName":"openshift-pipelines/pipelines-hub-ui-rhel9","product":"OpenShift Pipelines","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:3"],"defaultStatus":"unaffected","packageName":"openshift-service-mesh/kiali-operator-bundle","product":"OpenShift Service Mesh 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:3"],"defaultStatus":"unaffected","packageName":"openshift-service-mesh/kiali-rhel9-operator","product":"OpenShift Service Mesh 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7"],"defaultStatus":"unaffected","packageName":"shell-quote","product":"Red Hat AMQ Broker 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-26/gateway-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/lightspeed-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"automation-eda-controller","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"automation-gateway","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"automation-platform-ui","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"defaultStatus":"unaffected","packageName":"shell-quote","product":"Red Hat build of Apache Camel - HawtIO 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:1"],"defaultStatus":"affected","packageName":"rh-podman-desktop.git","product":"Red Hat Build of Podman Desktop","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:0"],"defaultStatus":"affected","packageName":"rhdesktop/rh-podman-desktop-ext-bootc-rhel10","product":"Red Hat Build of Podman Desktop - Tech Preview","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"unaffected","packageName":"shell-quote","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"goose","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"grafana","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"pcs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"goose","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"grafana","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"pcs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-cuda-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gaudi-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-rocm-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/disk-image-cuda-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"affected","packageName":"shell-quote","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-rhel8","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-agent-installer-ui-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:container_native_virtualization:4"],"defaultStatus":"affected","packageName":"container-native-virtualization/kubevirt-console-plugin-rhel9","product":"Red Hat OpenShift Virtualization 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_artifact_signer:1"],"defaultStatus":"unaffected","packageName":"rhtas/rekor-search-ui-rhel9","product":"Red Hat Trusted Artifact Signer","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_portal:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform/automation-portal","product":"Self-service automation portal 2","vendor":"Red Hat"}],"datePublic":"2026-05-22T13:22:38.873Z","descriptions":[{"lang":"en","value":"A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-21T12:05:10.203Z","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-9277"},{"name":"RHBZ#2480741","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480741"},{"tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28010"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:36754"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:33574"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26234"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:29197"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:34791"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:29834"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:29795"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26072"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26080"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26077"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26079"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26090"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:30076"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:41066"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:33683"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28571"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:26225"}],"solutions":[{"lang":"en","value":"RHSA-2026:28010: Cryostat 4 on RHEL 9"},{"lang":"en","value":"RHSA-2026:34342: Cluster Observability Operator 1.5.0"},{"lang":"en","value":"RHSA-2026:36754: Red Hat Developer Hub 1.10"},{"lang":"en","value":"RHSA-2026:33574: Red Hat Developer Hub 1.9"},{"lang":"en","value":"RHSA-2026:26234: Red Hat Developer Hub 1.9"},{"lang":"en","value":"RHSA-2026:29197: Red Hat Discovery 2"},{"lang":"en","value":"RHSA-2026:41928: Red Hat Migration Toolkit 1.8"},{"lang":"en","value":"RHSA-2026:34791: Red Hat OpenShift Container Platform 4.20"},{"lang":"en","value":"RHSA-2026:29834: Red Hat OpenShift Container Platform 4.21"},{"lang":"en","value":"RHSA-2026:29795: Red Hat OpenShift Container Platform 4.22"},{"lang":"en","value":"RHSA-2026:26072: Red Hat OpenShift Service Mesh 2.6"},{"lang":"en","value":"RHSA-2026:26080: Red Hat OpenShift Service Mesh 3.0"},{"lang":"en","value":"RHSA-2026:26077: Red Hat OpenShift Service Mesh 3.1"},{"lang":"en","value":"RHSA-2026:26079: Red Hat OpenShift Service Mesh 3.2"},{"lang":"en","value":"RHSA-2026:26090: Red Hat OpenShift Service Mesh 3.3"},{"lang":"en","value":"RHSA-2026:30076: Red Hat Quay 3.12"},{"lang":"en","value":"RHSA-2026:41066: Red Hat Quay 3.16"},{"lang":"en","value":"RHSA-2026:33683: Red Hat Quay 3.1"},{"lang":"en","value":"RHSA-2026:28571: Red Hat Quay 3.9"},{"lang":"en","value":"RHSA-2026:26225: Red Hat Satellite 6.18"}],"timeline":[{"lang":"en","time":"2026-05-22T14:01:14.427Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-22T13:22:38.873Z","value":"Made public."}],"title":"shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators","x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}],"cna":{"affected":[{"collectionURL":"https://www.npmjs.com/package/shell-quote","defaultStatus":"unaffected","packageName":"shell-quote","product":"shell-quote","programFiles":["quote.js"],"repo":"https://github.com/ljharb/shell-quote","versions":[{"lessThan":"1.8.4","status":"affected","version":"1.1.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Akshat Sinha (@akshatgit)"},{"lang":"en","type":"remediation developer","value":"Jordan Harband (@ljharb)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.</p>"}],"value":"shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-22T13:22:38.873Z","orgId":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","shortName":"harborist"},"references":[{"name":"GHSA-w7jw-789q-3m8p","tags":["vendor-advisory"],"url":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"},{"name":"Fix commit","tags":["patch"],"url":"https://github.com/ljharb/shell-quote/commit/1518179"},{"tags":["product"],"url":"https://github.com/ljharb/shell-quote"},{"tags":["product"],"url":"https://www.npmjs.com/package/shell-quote"}],"source":{"advisory":"GHSA-w7jw-789q-3m8p","discovery":"EXTERNAL"},"title":"shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`"}},"cveMetadata":{"assignerOrgId":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","assignerShortName":"harborist","cveId":"CVE-2026-9277","datePublished":"2026-05-22T13:22:38.873Z","dateReserved":"2026-05-22T12:13:25.893Z","dateUpdated":"2026-07-21T12:05:10.203Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-22 14:16:30","lastModifiedDate":"2026-07-21 12:19:04","problem_types":["CWE-77","CWE-78","CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","CWE-77 CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":{"cvssMetricV40":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-22T14:17:31.964845Z","id":"CVE-2026-9277","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"9277","Ordinal":"1","Title":"shell-quote `quote()` does not validate object-token shapes, all","CVE":"CVE-2026-9277","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"9277","Ordinal":"1","NoteData":"shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.","Type":"Description","Title":"shell-quote `quote()` does not validate object-token shapes, all"}]}}}