UbuntuUpdates.org

Package "node-shell-quote"

Name: node-shell-quote

Description:

quote and parse shell commands
Latest version: 1.7.4+~1.7.1-1ubuntu0.25.10.1
Release: questing (25.10)
Level: security
Repository: universe
Homepage: https://github.com/ljharb/node-shell-quote

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "node-shell-quote"

All arch deb package
APT INSTALL

Other versions of "node-shell-quote" in Questing

Repository Area Version
base universe 1.7.4+~1.7.1-1
updates universe 1.7.4+~1.7.1-1ubuntu0.25.10.1

Changelog

Version: 1.7.4+~1.7.1-1ubuntu0.25.10.1 2026-06-09 11:07:44 UTC

  node-shell-quote (1.7.4+~1.7.1-1ubuntu0.25.10.1) questing-security; urgency=medium

  * SECURITY UPDATE: command injection vulnerability
    - debian/patches/CVE-2026-9277.patch: `quote`: validate object-token
      shapes in quote.js
    - CVE-2026-9277

 -- Shishir Subedi <email address hidden> Tue, 09 Jun 2026 13:23:02 +0545
CVE-2026-9277 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc


About   -   Send Feedback to @ubuntu_updates