CVE-2026-102422

About vulnerability

Impact

quote() emits a { comment } token as # followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input:

quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#']);
// echo ok #x 'a
// id;#'

Passed to sh, bash, dash, ksh, or zsh, this runs id.

parse() emits a comment token for a # in the middle of a word (for example http://example.com/#frag), so callers that combine parse() output with another untrusted string, such as quote(parse(untrustedCommand).concat(untrustedArg)), are affected. The fix for CVE-2026-9277 rejected line terminators in the comment’s own text, but not in the tokens after it.

Exploitation requires an attacker-controlled string containing a line terminator that follows a { comment } token in the same quote() call.

Patches

Fixed in v1.11.0: quote() throws a TypeError when a string after a { comment } token contains a line terminator (\n, \r, U+2028, or U+2029).

Workarounds

Drop every token after a { comment } token before calling quote(), or reject line terminators in untrusted strings. Separately, do not append other shell text after quote() output that contains a comment, since the comment swallows it.

Affected product:

AngularJS , Node.js , React , Vue , amplify-js , angular-pwa , appium , appium-adb , appium-base-driver , appium-base-plugin , appium-chromedriver , appium-coresim , appium-execute-driver-plugin , appium-fake-driver , appium-fake-plugin , appium-ios , appium-ios-device , appium-ios-remotexpc , appium-ios-simulator , appium-relaxed-caps-plugin , appium-remote-debugger , appium-support , appium-xcode , async-storage , babel-preset-expo , browserify , bugsnag-js , bugsnag-plugin-node-device , bugsnag-plugin-node-in-project , bugsnag-plugin-node-surrounding-code , bugsnag-plugin-node-uncaught-exception , bugsnag-plugin-node-unhandled-rejection , bugsnag-plugin-react-native-client-sync , bugsnag-plugin-react-native-hermes , bugsnag-plugin-react-native-navigation , bugsnag-plugin-react-native-orientation-breadcrumbs , bugsnag-plugin-react-native-session , bugsnag-plugin-react-native-unhandled-rejection , bugsnag-plugin-react-navigation , bugsnag-plugin-restify , bugsnag-plugin-simple-throttle , bugsnag-plugin-stackframe-path-normaliser , bugsnag-plugin-strip-project-root , bugsnag-plugin-strip-query-string , bugsnag-plugin-vue , bugsnag-plugin-window-onerror , bugsnag-plugin-window-unhandled-rejection , bugsnag-react-native , bugsnag-web-worker , changesets , clients , concurrently , create-react-app , create-storybook , create-strapi , create-strapi-app , create-zephyr-apps , daytona-sdk , daytonaio-sdk , definitelytyped , devtools , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , eslint-config-expo , eslint-config-universe , expo , expo-app-integrity , expo-apple-authentication , expo-application , expo-asset , expo-audio , expo-auth-session , expo-av , expo-background-fetch , expo-background-task , expo-barcode-scanner , expo-battery , expo-blur , expo-branch , expo-brightness , expo-build-properties , expo-calendar , expo-camera , expo-cli , expo-clipboard , expo-config , expo-constants , expo-contacts , expo-crypto , expo-dev-client , expo-dev-launcher , expo-dev-menu , expo-dev-menu-interface , expo-dev-server , expo-device , expo-document-picker , expo-env-info , expo-error-recovery , expo-file-system , expo-font , expo-gl , expo-glass-effect , expo-haptics , expo-image , expo-image-loader , expo-image-picker , expo-insights , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-authentication , expo-local-build-cache-provider , expo-localization , expo-location , expo-log-box-utils , expo-mail-composer , expo-manifests , expo-maps , expo-media-library , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-notifications , expo-prebuild-config , expo-print , expo-processing , expo-pwa , expo-router , expo-router-server , expo-schemer , expo-screen-capture , expo-screen-orientation , expo-secure-store , expo-sensors , expo-sharing , expo-sms , expo-speech , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-store-review , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-updates , expo-updates-interface , expo-vector-icons , expo-video , expo-video-thumbnails , expo-web-browser , expo-widgets , flagsmith-js-client , gatsby , gel , graphql-code-generator , graphql-codegen-add , graphql-codegen-client-preset , graphql-codegen-core , graphql-codegen-gql-tag-operations , graphql-codegen-schema-ast , graphql-codegen-typed-document-node , graphql-codegen-typescript , graphql-codegen-typescript-document-nodes , graphql-codegen-typescript-resolvers , hiero-sdk-js , ink , ink-text-input , io.appium.settings , jest-expo , json-render , json-render-codegen , json-render-core , json-render-devtools , json-render-devtools-react , json-render-devtools-solid , json-render-devtools-svelte , json-render-devtools-vue , json-render-directives , json-render-image , json-render-ink , json-render-mcp , json-render-next , json-render-react , json-render-react-email , json-render-react-native , json-render-react-pdf , json-render-react-three-fiber , json-render-redux , json-render-remotion , json-render-shadcn , json-render-shadcn-svelte , json-render-solid , json-render-svelte , json-render-tanstack-start , json-render-vue , json-render-xstate , json-render-yaml , json-render-zustand , launch-editor , lingui-babel-plugin-lingui-macro , lingui-detect-locale , lingui-extractor-vue , lingui-format-csv , lingui-format-json , lingui-loader , lingui-metro-transformer , lingui-solid , localforage-asyncstorage-driver , lottie-react-native , magic-js , magiclabs/magic-js , masked-view , metamask-core , metamask-snaps-cli , microsoft-365-agents-toolkit , mobile-wallet-adapter , module-federation-bridge-react-webpack-plugin , module-federation-bridge-shared , module-federation-bridge-vue3 , module-federation-core , module-federation-data-prefetch , module-federation-error-codes , module-federation-managers , module-federation-retry-plugin , module-federation-runtime , module-federation-runtime-core , module-federation-runtime-tools , module-federation-third-party-dts-extractor , module-federation-webpack-bundler-runtime , module-federation/core , native-html-css-processor , native-html-transient-render-engine , nitro , nuxt , nuxt-docs , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-schema , nuxt-vite-builder , nuxt-webpack-builder , onflow-fcl-react-native , op-sqlite , opentui , opentui-core , opentui-qrcode , opentui-solid , opentui-ssh , opentui-three , patch-project , posthog-react-native-plugin , recyclerlistview , rollup-plugin-zephyr , rspack-dev-server , rushstack , rushstack-heft-rspack-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , sb , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-nitro , sentry-node-native , sentry-nuxt , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , shell-quote , solana-mobile-mobile-wallet-adapter-protocol , solana-mobile-mobile-wallet-adapter-protocol-web3js , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-themes , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , teen_process , victory-native , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , wallet-adapter , walletconnect-core , walletconnect-ethereum-provider , walletconnect-monorepo , walletconnect-sign-client , walletconnect-signer-connection , walletconnect-types , walletconnect-universal-provider , walletconnect-utils , webpack-dev-server , with-zephyr , x402 , x402-aptos , x402-evm , x402-express , x402-extensions , x402-hono , x402-mcp , x402-next , x402-paywall , yarnpkg-libui , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-native-cache , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-tap-runtime , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

shell-quote @ 1.10.0 (+3753 more)