The shell-quote library's quote() function failed to properly neutralize special elements used in OS commands, specifically line terminators in the .op field of object tokens. The original escaping method did not cover line terminators, which POSIX shells treat as command separators, enabling command injection. The vulnerability can be triggered either by directly constructing tokens with malicious .op values containing line terminators or indirectly via the parse() function when an environment function returns attacker-influenced tokens. The issue was fixed by replacing per-character escaping with strict shape validation, ensuring .op matches a control-operator allowlist and forbidding line terminators in patterns and comments.

An attacker can exploit this vulnerability to execute arbitrary operating system commands remotely without authentication, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability by allowing unauthorized code execution, data modification, and denial of service. Because the commands execute with the privileges of the vulnerable application, malicious actions may appear to originate from the application or its owner.

An official fix is available and has been released that enforces strict validation of the .op field and forbids line terminators in tokens. Users should upgrade to the fixed version of shell-quote. The Red Hat advisory confirms the availability of a security update addressing this issue. No additional mitigations are specified beyond applying the official patch.