All 3 CVE vulnerabilities found in shell-quote, with AI-generated Chinese analysis, references, and POCs.
Vendor: ljharb
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-102422 | shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token CWE-78 | 8.1 | High | 2026-09-29 |
| CVE-2026-13311 | shell-quote parse() is quadratic in token count, enabling denial of service CWE-407 | 7.5 | High | 2026-06-25 |
| CVE-2026-9277 | shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op` CWE-78 | 8.1 | High | 2026-05-22 |
All 3 known CVE vulnerabilities affecting shell-quote with full Chinese analysis, references, and POCs where available.