shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments
    out the rest of the shell line, including the opening quote of any later string token. A line terminator
    (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is
    parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash,
    ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example
    `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such
    as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected
    line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()`
    throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.
    (CVE-2026-102422)

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6548 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6548-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 06, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : node-shell-quote     CVE ID         : CVE-2026-13311 CVE-2026-102422     Debian Bug     : 1140921 1149713

    Two vulnerabilities were discovered in node-shell-quote, a Node.js     module to quote and parse shell commands, which could result in denial     of service or shell command injection.

    For the stable distribution (trixie), these problems have been fixed in     version 1.7.4+~1.7.1-1+deb13u2.

    We recommend that you upgrade your node-shell-quote packages.

    For the detailed security status of node-shell-quote please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/node-shell-quote

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments     out the rest of the shell line, including the opening quote of any later string token. A line terminator     (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is     parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash,     ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example     `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such     as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected     line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()`     throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.
    (CVE-2026-102422)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473647	Chainguard: renovate: security update to 44.133.0-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	critical
473647	Chainguard: renovate: security update to 44.133.0-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	critical
473445	SCA: security update for shell-quote (GHSA-pqg4-j6r4-53mv)	Tenable Cloud Security	SCA Checks	Local	critical
473445	SCA: security update for shell-quote (GHSA-pqg4-j6r4-53mv)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
363443	Debian dsa-6548 : node-shell-quote - security update	Nessus	Debian Local Security Checks	Local	critical
351391	Linux Distros Unpatched Vulnerability : CVE-2026-102422	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-102422

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical