CVE-2026-102422

Name of the Vulnerable Software and Affected Versions shell-quote versions prior to 1.11.0

Description The quote() function emits a { comment } token starting with #, which comments out the remainder of the shell line, including opening quotes of subsequent string tokens. If a subsequent string contains a line terminator (such as , r, U+2028, or U+2029), the comment is terminated, and the remaining part of the string is executed as shell input. Additionally, the parse() function generates a comment token when a # character appears in the middle of a word. This can lead to issues when callers combine the output of parse() with other untrusted strings.

Recommendations Update shell-quote to version 1.11.0.