{
  "cveId": "CVE-2026-102422",
  "url": "https://patchblox.com/security/cve/CVE-2026-102422",
  "summary": "CVE-2026-102422 is fixed in node-shell-quote on 1 platform, first by DEBIAN-CVE-2026-102422, released October 5, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "node-shell-quote: shell-quote\u0027s \u0060quote()\u0060 function emits a \u0060{ comment }\u0060 token as \u0060#\u0060 followed by its text, which comments out the rest...",
  "description": "shell-quote\u0027s \u0060quote()\u0060 function emits a \u0060{ comment }\u0060 token as \u0060#\u0060 followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\\n, \\r, U\u002B2028, U\u002B2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: \u0060quote([\u0027echo\u0027, \u0027ok\u0027, { comment: \u0027x\u0027 }, \u0027a\\nid;#\u0027])\u0060 runs \u0060id\u0060 in sh, bash, dash, ksh and zsh. \u0060parse()\u0060 emits a comment token for a \u0060#\u0060 in the middle of a word (for example \u0060http://example.com/#frag\u0060), so callers that combine \u0060parse()\u0060 output with another untrusted string, such as \u0060quote(parse(untrustedCommand).concat(untrustedArg))\u0060, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment\u0027s own text, but not in the tokens after it. Fixed in 1.11.0: \u0060quote()\u0060 throws a \u0060TypeError\u0060 when a string after a \u0060{ comment }\u0060 token contains a line terminator.",
  "published": "2026-09-29T04:17:55Z",
  "severity": "",
  "epss": 0.00378,
  "epssPercentile": 0.3196,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-shell-quote",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.7.4\u002B~1.7.1-1\u002Bdeb13u2",
      "fix": "DEBIAN-CVE-2026-102422",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-102422",
      "released": "2026-10-05T21:42:17Z"
    },
    {
      "platform": "linux",
      "product": "node-shell-quote",
      "release": "Debian 14",
      "fixedVersion": "1.12.0-1",
      "fix": "DEBIAN-CVE-2026-102422",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-102422",
      "released": "2026-10-05T21:42:17Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}