Detections
Analytics

SCA: security update for shell-quote (GHSA-pqg4-j6r4-53mv)

critical Tenable Cloud Security Plugin ID 473445

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments
 out the rest of the shell line, including the opening quote of any later string token. A line terminator
 (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is
 parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash,
 ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example
 `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such
 as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected
 line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()`
 throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.
 (CVE-2026-102422)

Solution

Update the shell-quote library and its related packages to version 1.11.0 or later.

See Also

https://github.com/advisories/GHSA-pqg4-j6r4-53mv

Plugin Details

Severity: Critical

ID: 473445

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.51

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-102422

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/6/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-102422

cwe: CWE-78