CVE-2026-9277

描述

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

如何修補 CVE-2026-9277

要修補 CVE-2026-9277,請將受影響套件升級到下列已修補版本。

• —升級至 1.7.4+~1.7.1-1+deb12u1 或更新版本
• —升級至 1.8.4 或更新版本

CVE-2026-9277 正在被利用嗎?

低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 1.7.4+~1.7.1-1+deb12u1
• >= 1.1.0, < 1.8.4

CVSS 分數

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-9277
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-9277
• PATCHgithub.com/ljharb/shell-quote
• WEBwww.openwall.com/lists/oss-security/2026/05/23/2
• WEB