The shell-quote library version 1.1.0 contains an OS command injection vulnerability (CVE-2026-9277) due to improper neutralization of special elements in the quote() function. Specifically, the function escapes characters in the .op field using a regex that does not match line terminators, allowing newline characters to pass unescaped. Since POSIX shells treat newlines as command separators, this enables injection of additional commands. The vulnerability can be exploited by crafting object tokens with malicious .op fields or by influencing the environment function passed to parse(). The fix involves replacing per-character escaping with strict validation that enforces an allowlist of control operators and forbids line terminators in patterns and comments. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary OS commands by injecting newline characters that separate commands in shell execution contexts. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid passing untrusted input to the shell-quote library's quote() or parse() functions, especially in contexts where .op fields can be influenced. Consider implementing input validation to reject tokens containing line terminators or avoid using affected versions of shell-quote. Monitor vendor channels for updates and apply official patches once available.