Loading story…
A high-severity command injection vulnerability, CVE-2026-9277, was disclosed in the Node.js package shell-quote affecting versions through 1.8.3. The flaw is in quote(), which escaped attacker-influenced object-token .op values character by character using a JavaScript regex that does not match line terminators. Because POSIX shells treat newlines as command separators, a crafted .op containing \n, \r, U+2028, or U+2029 could cause a second command to run when the resulting string was passed to /bin/sh.
The issue is narrower than a typical shell injection because exploitation requires applications to use documented object tokens, either directly or through parse(cmd, envFn) when envFn returns an object with an attacker-controlled .op field. A proof of concept showed that injected content could trigger execution of a follow-on command such as id. Version 1.8.4 fixes the bug by replacing arbitrary escaping with strict validation and allowlisting of valid operators, and by blocking line terminators in related token fields such as glob patterns and comments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was publicly disclosed on 2026-05-22 with details explaining that unescaped line terminators in .op could let POSIX shells treat injected newlines as command separators and execute a second command. Public reporting included proof-of-concept behavior and noted affected versions up to and including 1.8.3.
On 2026-05-22, shell-quote version 1.8.4 was released to fix the vulnerability by replacing arbitrary .op escaping with strict validation and allowlisting of valid operator values. The fix also forbade line terminators in related token fields such as glob patterns and comments.
A command injection vulnerability in the shell-quote package, later assigned CVE-2026-9277, was reported on 2026-05-09. The flaw affected quote() when applications passed object tokens with attacker-influenced .op values.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity command injection vulnerabilities have been disclosed in developer tooling and automation software, enabling arbitrary command execution through improperly sanitized shell inputs. `CVE-2026-32917` affects OpenClaw versions earlier than `2026.3.13`, where the iMessage attachment staging workflow passes unsanitized remote attachment paths directly into an SCP remote operand. If remote attachment staging is enabled, an unauthenticated attacker can use shell metacharacters in attachment paths to execute commands on configured remote hosts; the flaw is tracked as `CWE-78` and carries a CVSS v3.1 rating of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. A separate issue, `CVE-2026-35020`, impacts Anthropic Claude Code CLI and the Claude Agent SDK, where attacker-controlled input from the `TERMINAL` environment variable can reach `/bin/sh` with `shell=true` through the command lookup helper and deep-link terminal launcher. A local attacker can exploit the bug during normal CLI use or via the deep-link handler to run arbitrary commands with the privileges of the invoking user. Both disclosures highlight continued risk from unsanitized shell metacharacters in application workflows, with OpenClaw publishing a fixing commit and security advisory alongside third-party vulnerability reporting.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-1245** was disclosed in the npm binary data parsing library **`binary-parser`**, allowing remote unauthenticated attackers to inject and execute arbitrary JavaScript within a Node.js process. CERT/CC assigned the issue **VU#102648**, and CSIRT.SK reported that the flaw stems from insufficient validation of user-controlled field names and encoding parameters that are incorporated into dynamically generated JavaScript code.
Jul 24, 2026
A high-severity vulnerability tracked as **`CVE-2026-71312`** allows command injection in **rclone** versions prior to **`1.75.0`** when the tool interacts with SFTP servers running Windows PowerShell. The flaw stems from improper escaping in rclone's path-handling logic: it escaped only ASCII single quotes, while PowerShell also accepts several Unicode “smart quote” characters as valid string delimiters. A malicious filename on an attacker-controlled or untrusted SFTP path can therefore break out of the intended quoted string and inject arbitrary PowerShell commands. The issue affects server-side hashing and related operations including **`rclone hash`**, **`rclone check`**, and **`rclone sync`**, potentially executing code as the victim SSH account on the remote SFTP server. Public reporting classifies the bug as **`CWE-78`** OS command injection and lists it as remotely exploitable, with a **CVSS v3.1** vector of **`AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`**. rclone addressed the vulnerability in **`1.75.0`** by adding escaping for multiple Unicode smart-quote characters, and users are advised to upgrade and avoid server-side hashing against untrusted SFTP paths.
Aug 6, 2026