shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20919-1 advisory.

    This update for agama-web-ui fixes the following issues

    - CVE-2025-7339: on-headers: incorrect array handling may lead to HTTP response header manipulation     (bsc#1246678).
    - CVE-2026-9277: shell-quote: improper escaping of newlines in object .op values by quote() can lead to     shell command       injection (bsc#1266256).
    - CVE-2026-42041: axios: authentication bypass via validateStatus prototype pollution gadget due to     suppression of HTTP       error (bsc#1264160).
    - CVE-2026-42264: axios: prototype pollution read-side gadgets in HTTP adapter can lead to credential     injection and       request h (bsc#1264802).

    Changes for agama-web-ui:

    - Update other dependencies reported by npm audit.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8410-1 advisory.

    Akshat Sinha discovered that shell-quote improperly validated object-token inputs. An attacker could     possibly use this issue to cause shell-quote to crash, resulting in a denial of service, or execute     arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20839-1 advisory.

    Changes in python-pytest-html:

    - CVE-2026-9277: shell-quote: improper escaping of newlines (bsc#1266254)       Update the vendored shell-quote to 1.8.4 node_modules

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6300 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6300-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 26, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : node-shell-quote     CVE ID         : CVE-2026-9277

    Akshat Sinha discovered that incorrect input sanitising in     node-shell-quote, a Node.js module to quote and parse shell commands,     could result in shell command injection.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 1.7.4+~1.7.1-1+deb12u1.

    For the stable distribution (trixie), this problem has been fixed in     version 1.7.4+~1.7.1-1+deb13u1.

    We recommend that you upgrade your node-shell-quote packages.

    For the detailed security status of node-shell-quote please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-shell-quote

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - shell-quote's `quote()` function did not validate object-token inputs against the operator model used by     `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in     JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore     passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so     any content after it would execute as a second command. The vulnerable code path is reachable in two ways:
    (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when     `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed     by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-     operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment     }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.
    (CVE-2026-9277)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
320412	openSUSE 16 Security Update : agama-web-ui (openSUSE-SU-2026:20919-1)	Nessus	SuSE Local Security Checks	critical
320394	Ubuntu 18.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : shell-quote vulnerability (USN-8410-1)	Nessus	Ubuntu Local Security Checks	critical
318100	openSUSE 16 Security Update : python-pytest-html (openSUSE-SU-2026:20839-1)	Nessus	SuSE Local Security Checks	critical
316925	Debian dsa-6300 : node-shell-quote - security update	Nessus	Debian Local Security Checks	critical
316598	Linux Distros Unpatched Vulnerability : CVE-2026-9277	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-9277

critical

Tenable Plugins

critical

critical

critical

critical

critical