The shell-quote library's quote() function failed to properly escape line terminators in the .op field of object tokens, due to the use of a JavaScript regex that does not match line terminators. This allowed unescaped newlines to be injected into shell commands, which POSIX shells interpret as command separators, leading to OS command injection. The vulnerability is exploitable via two documented API surfaces: direct construction of malicious { op: '...\n...' } objects, and via parse(cmd, envFn) when envFn returns attacker-controlled tokens. The fix replaced per-character escaping with strict validation ensuring .op matches a control-operator allowlist and forbids line terminators, throwing TypeError for invalid shapes. Red Hat advisories confirm the vulnerability and provide patches for affected products.

Successful exploitation allows an attacker to inject arbitrary OS commands due to improper neutralization of special elements (line terminators) in shell commands. This can lead to arbitrary code execution with the privileges of the affected application. The CVSS 3.1 base score is 8.1 (High), indicating high confidentiality, integrity, and availability impacts without requiring privileges or user interaction. No known exploits in the wild have been reported at this time.

Red Hat has released security advisories and updates addressing CVE-2026-9277. Users of affected versions (shell-quote 1.1.0) should apply the vendor-provided patches or updates as soon as possible. The vulnerability is fixed by enforcing strict validation of the .op field and forbidding line terminators in object tokens. Patch status is not explicitly stated in the input data, but multiple Red Hat errata references indicate that fixes are available. Check the Red Hat advisories linked for detailed update instructions and ensure all relevant errata are applied.