{"schemaVersion":3,"id":"CVE-2026-102422","aliases":["RHSA-2026:69544","RHSA-2026:72750","UBUNTU-CVE-2026-102422","DEBIAN-CVE-2026-102422","CGA-6vjc-vp8r-27xh","CGA-g9xq-c429-9rg8","CGA-ghc6-85ww-h3mh","CGA-h5v4-6wfj-hwpx","GHSA-pqg4-j6r4-53mv","CGA-22fx-q5h3-vrcp","CGA-2h9r-v78q-96jv","CGA-2j32-x6pc-f444","CGA-4gcq-7h7w-fh33","CGA-562w-6frw-9h3q","CGA-5p7x-xg9w-j6vx","CGA-5wq9-57g9-8xc2","CGA-6hgx-m5pv-3cqx","CGA-6hhg-c5gf-cxvf","CGA-7mp8-7x65-6cr8","CGA-7xjq-cxqw-2462","CGA-86xj-hm34-92pr","CGA-9jmc-48wg-x99r","CGA-c2v9-93x7-fxrg","CGA-c8qx-jw7w-93xp","CGA-cq4j-2h5f-fwc3","CGA-f4f8-9636-f5m2","CGA-f8pv-6rfw-q27q","CGA-fg4v-5g95-79wq","CGA-fp4p-5f4v-x5m9","CGA-g458-f3wr-cmg2","CGA-gjc4-563w-3m25","CGA-gmcf-jp57-p9c2","CGA-gmr6-mc4c-wx3q","CGA-gw4f-3599-px9f","CGA-h27q-979c-wrmx","CGA-h79p-fw45-gfw7","CGA-h8f4-xgxw-7vg5","CGA-hqw3-rhf4-g43j","CGA-j6qm-88f6-j239","CGA-jhgq-rr8x-6gj4","CGA-jhqp-j738-9gwv","CGA-mfrh-qpmw-rcrf","CGA-p6c7-82v9-3844","CGA-pqx6-mmqj-c3j2","CGA-q2qr-m67w-prmf","CGA-q8m8-rj92-f3x7","CGA-qmp7-x3q4-7ffq","CGA-qpqx-hffx-92p5","CGA-v38h-45pv-8m4g","CGA-v55x-8c6p-374h","CGA-vmfh-3hfh-558v","CGA-vwq8-v24m-r9q3","CGA-w9xq-j853-2c8m"],"status":"published","duplicateOf":null,"title":null,"description":"shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\\n, \\r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.","dates":{"published":"2026-09-29T03:47:36.376Z","modified":"2026-09-30T15:18:32.135Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.2,"severity":"critical","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":5.6,"impact":9.8,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":5.6,"impact":9.8,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":5.6,"impact":9.8,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00383,"percentile":0.3085,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-29T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00383,"percentile":0.3085}],"last30":[{"date":"2026-09-29T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00383,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00383,"percentile":0.3085}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"chainguard","product":"arangodb-3.12","name":"arangodb-3.12","label":"arangodb-3.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.12","purlType":"apk","versions":[{"text":"< 3.12.12.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.12.12.1-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/code-server","purlType":"apk","versions":[{"text":"< 4.141.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.141.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.2","name":"commercial-gitlab-rails-ee-19.2","label":"commercial-gitlab-rails-ee-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.3","name":"commercial-gitlab-rails-ee-19.3","label":"commercial-gitlab-rails-ee-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.4","name":"commercial-gitlab-rails-ee-19.4","label":"commercial-gitlab-rails-ee-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.2","name":"commercial-gitlab-rails-ee-fips-19.2","label":"commercial-gitlab-rails-ee-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.3","name":"commercial-gitlab-rails-ee-fips-19.3","label":"commercial-gitlab-rails-ee-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.4","name":"commercial-gitlab-rails-ee-fips-19.4","label":"commercial-gitlab-rails-ee-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"eco-jess","name":"eco-jess","label":"eco-jess","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/eco-jess","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gemini-cli","name":"gemini-cli","label":"gemini-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gemini-cli","purlType":"apk","versions":[{"text":"< 0.63.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.63.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.3","name":"gitlab-rails-ce-19.3","label":"gitlab-rails-ce-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.4","name":"gitlab-rails-ce-19.4","label":"gitlab-rails-ce-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.8-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.8-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.3","name":"gitlab-rails-ce-fips-19.3","label":"gitlab-rails-ce-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.4","name":"gitlab-rails-ce-fips-19.4","label":"gitlab-rails-ce-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/renovate","purlType":"apk","versions":[{"text":"< 44.133.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 44.133.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/code-server","purlType":"apk","versions":[{"text":"< 4.141.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.141.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/renovate","purlType":"apk","versions":[{"text":"< 44.133.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 44.133.0-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"node-shell-quote","name":"node-shell-quote","label":"node-shell-quote","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-shell-quote","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.7.4+~1.7.1-1+deb13u2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.12.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.7.4+~1.7.1-1+deb13u2 | < 1.12.0-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-shell-quote","name":"node-shell-quote","label":"node-shell-quote","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-shell-quote","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"shell-quote","name":"shell-quote","label":"shell-quote","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/shell-quote","purlType":"npm","versions":[{"text":"≥ 1.8.4, < 1.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.8.4, < 1.11.0","eol":null,"hubHref":null},{"vendor":"redhat","product":"jaeger","name":"jaeger","label":"jaeger","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/jaeger","purlType":"rpm","versions":[{"text":"< 0:2.20.0-0.11.hum1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:2.20.0-0.11.hum1","eol":null,"hubHref":null},{"vendor":"redhat","product":"prometheus3.13","name":"prometheus3.13","label":"prometheus3.13","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/prometheus3.13","purlType":"rpm","versions":[{"text":"< 0:3.13.3-0.2.hum1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:3.13.3-0.2.hum1","eol":null,"hubHref":null}],"affectedCount":30,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","label":"github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","hostname":"github.com","tags":["Vendor Advisory","ARTICLE","REPORT","Advisory","WEB"]},{"url":"https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","label":"github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","hostname":"github.com","tags":["Patch","ARTICLE","REPORT","FIX","WEB"]},{"url":"https://github.com/ljharb/shell-quote","label":"github.com/ljharb/shell-quote","hostname":"github.com","tags":["Product","ARTICLE","REPORT","PACKAGE"]},{"url":"https://www.npmjs.com/package/shell-quote","label":"www.npmjs.com/package/shell-quote","hostname":"www.npmjs.com","tags":["Product","ARTICLE","REPORT","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69544","label":"access.redhat.com/errata/RHSA-2026:69544","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://images.redhat.com/","label":"images.redhat.com","hostname":"images.redhat.com","tags":["ARTICLE"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102422","label":"access.redhat.com/security/cve/CVE-2026-102422","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://access.redhat.com/security/updates/classification/","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69544.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69544.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542933","label":"bugzilla.redhat.com/show_bug.cgi?id=2542933","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102422","label":"www.cve.org/CVERecord?id=CVE-2026-102422","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102422","label":"nvd.nist.gov/vuln/detail/CVE-2026-102422","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72750","label":"access.redhat.com/errata/RHSA-2026:72750","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93450","label":"access.redhat.com/security/cve/CVE-2026-93450","hostname":"access.redhat.com","tags":["ARTICLE","REPORT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56851","label":"access.redhat.com/security/cve/CVE-2026-56851","hostname":"access.redhat.com","tags":["ARTICLE","REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72750.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72750.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-102422","label":"ubuntu.com/security/CVE-2026-102422","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-102422","label":"security-tracker.debian.org/tracker/CVE-2026-102422","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102422.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102422.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547607","label":"bugzilla.redhat.com/show_bug.cgi?id=2547607","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56851","label":"www.cve.org/CVERecord?id=CVE-2026-56851","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","label":"nvd.nist.gov/vuln/detail/CVE-2026-56851","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://go.dev/cl/793360","label":"go.dev/cl/793360","hostname":"go.dev","tags":["ARTICLE"]},{"url":"https://go.dev/issue/80112","label":"go.dev/issue/80112","hostname":"go.dev","tags":["ARTICLE"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6629","label":"pkg.go.dev/vuln/GO-2026-6629","hostname":"pkg.go.dev","tags":["Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538979","label":"bugzilla.redhat.com/show_bug.cgi?id=2538979","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93450","label":"www.cve.org/CVERecord?id=CVE-2026-93450","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450","label":"nvd.nist.gov/vuln/detail/CVE-2026-93450","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/go-openapi/swag","label":"github.com/go-openapi/swag","hostname":"github.com","tags":["ARTICLE"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68","label":"github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go","hostname":"github.com","tags":["ARTICLE"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214","label":"github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go","hostname":"github.com","tags":["ARTICLE"]},{"url":"https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","label":"github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","hostname":"github.com","tags":["ARTICLE"]},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","label":"github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","hostname":"github.com","tags":["ARTICLE"]},{"url":"https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal","label":"www.vulncheck.com/advisories/…","hostname":"www.vulncheck.com","tags":["ARTICLE"]}],"lineage":{"upstream":["CVE-2026-56851","CVE-2026-93450"],"downstream":["RHSA-2026:72498","RHSA-2026:72507"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-29T03:47:36.376Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-30T15:18:32.135Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:29:19.354Z","stale":false,"partial":false}}