Vulnerability-Lookup

RHSA-2026:26072

Vulnerability from csaf_redhat - Published: 2026-06-15 21:28 - Updated: 2026-07-09 21:04

Summary

Red Hat Security Advisory: Kiali 1.73.32 for Red Hat OpenShift Service Mesh 2.6

Severity

Important

Notes

Topic: Kiali 1.73.32 for Red Hat OpenShift Service Mesh 2.6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Kiali 1.73.32, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-9277 openshift-service-mesh/kiali-rhel8: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (OSSM-13906) * CVE-2026-9277 openshift-service-mesh/kiali-ossmc-rhel8: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (OSSM-13905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-9277

A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64	—	Vendor Fix fix

Threats

Impact Important

References

13 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:26072	self
https://access.redhat.com/security/cve/CVE-2026-9277	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-9277	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480741	external
https://www.cve.org/CVERecord?id=CVE-2026-9277	external
https://nvd.nist.gov/vuln/detail/CVE-2026-9277	external
https://github.com/ljharb/shell-quote	external
https://github.com/ljharb/shell-quote/commit/1518179	external
https://github.com/ljharb/shell-quote/security/ad…	external
https://www.npmjs.com/package/shell-quote	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Kiali 1.73.32 for Red Hat OpenShift Service Mesh 2.6 is now available.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Kiali 1.73.32, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2026-9277 openshift-service-mesh/kiali-rhel8: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (OSSM-13906)\n* CVE-2026-9277 openshift-service-mesh/kiali-ossmc-rhel8: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators (OSSM-13905)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:26072",
        "url": "https://access.redhat.com/errata/RHSA-2026:26072"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9277",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9277"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26072.json"
      }
    ],
    "title": "Red Hat Security Advisory: Kiali 1.73.32 for Red Hat OpenShift Service Mesh 2.6",
    "tracking": {
      "current_release_date": "2026-07-09T21:04:13+00:00",
      "generator": {
        "date": "2026-07-09T21:04:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:26072",
      "initial_release_date": "2026-06-15T21:28:41+00:00",
      "revision_history": [
        {
          "date": "2026-06-15T21:28:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-09T08:56:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T21:04:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 2.6",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 2.6",
                  "product_id": "Red Hat OpenShift Service Mesh 2.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:2.6::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3A0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel8\u0026tag=1780916536"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3Ab5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8\u0026tag=1780907585"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3A9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel8\u0026tag=1780916536"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8\u0026tag=1780907585"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3A415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel8\u0026tag=1780916536"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8\u0026tag=1780907585"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3A53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel8\u0026tag=1780916536"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8\u0026tag=1780907585"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-9277",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-05-22T14:01:14.427751+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480741"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480741",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9277",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote",
          "url": "https://github.com/ljharb/shell-quote"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote/commit/1518179",
          "url": "https://github.com/ljharb/shell-quote/commit/1518179"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p",
          "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/shell-quote",
          "url": "https://www.npmjs.com/package/shell-quote"
        }
      ],
      "release_date": "2026-05-22T13:22:38.873000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-15T21:28:41+00:00",
          "details": "See Kiali 1.73.32 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:26072"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:1f41803cee88176e33d38072cdbbdee12a65ce3e277bcb86208589b15b8f5617_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2e34b2e8093a73db6291d08f97c8d0024eae1501234d357106756b755c53c95f_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5e8c9a77b41e4fb0b2ce4efc8202e157a9cc10eee21e3faa7b8fe99a378bea11_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:b5519a778cabdcb0e5be55a7623494dd375531a0b1ecc6510b0bf2ae831ab171_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:0425fb2f7d03cb753a5320b4e0c5f37cb1475ca9b73f1a2dbff26c59f1729edf_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:415828a4267fd071d4684ed15363916253441fd265e4fbc19eee79ae56af5e57_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:53ba9d76efb63ba3c173162e6077d6e6e69ab35f6729e8d398b5c5e710bdc282_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:9a87cf26aab9064de279d53d1d599a85f7e4d9a40c50ea6f427fd54e64c6379d_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators"
    }
  ]
}

CVE-2026-9277 (GCVE-0-2026-9277)

Vulnerability from cvelistv5 – Published: 2026-05-22 13:22 – Updated: 2026-07-10 12:05

Title

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Summary

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

harborist

References

26 references

URL	Tags
https://github.com/ljharb/shell-quote/security/ad…	vendor-advisory
https://github.com/ljharb/shell-quote/commit/1518179	patch
https://github.com/ljharb/shell-quote	product
https://www.npmjs.com/package/shell-quote	product
http://www.openwall.com/lists/oss-security/2026/05/23/2
https://access.redhat.com/security/cve/CVE-2026-9277	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2480741	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:28010	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26234	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34791	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29834	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29795	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26072	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26077	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26079	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26090	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26080	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33683	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30076	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28571	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26225	vendor-advisoryx_refsource_REDHAT

Impacted products

41 products

Vendor	Product	Version
	shell-quote	Affected: 1.1.0 , < 1.8.4 (semver)
Red Hat	Cryostat 4 on RHEL 9	cpe:/a:redhat:cryostat:4::el9
Red Hat	Cluster Observability Operator 1.5.0	cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Red Hat Developer Hub 1.10	cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Discovery 2	cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat OpenShift Service Mesh 2.6	cpe:/a:redhat:service_mesh:2.6::el8
Red Hat	Red Hat OpenShift Service Mesh 3.1	cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat Quay 3.10	cpe:/a:redhat:quay:3.10::el8
Red Hat	Red Hat Quay 3.12	cpe:/a:redhat:quay:3.12::el8
Red Hat	Red Hat Quay 3.9	cpe:/a:redhat:quay:3.9::el8
Red Hat	Red Hat Satellite 6.18	cpe:/a:redhat:satellite:6.18::el9
Red Hat	Migration Toolkit for Containers	cpe:/a:redhat:rhmt:1
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Build of Podman Desktop	cpe:/a:redhat:podman_desktop:1
Red Hat	Red Hat Build of Podman Desktop - Tech Preview	cpe:/a:redhat:podman_desktop:0
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Node HealthCheck Operator	cpe:/a:redhat:workload_availability_nhc:0
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1

Credits

Akshat Sinha (@akshatgit) Jordan Harband (@ljharb)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9277",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T14:17:31.964845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T14:17:39.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-23T03:04:40.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/23/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:2.6::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 2.6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:quay:3.10::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Quay 3.10",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:quay:3.12::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Quay 3.12",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:quay:3.9::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Quay 3.9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:satellite:6.18::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Satellite 6.18",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhmt:1"
            ],
            "defaultStatus": "affected",
            "product": "Migration Toolkit for Containers",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:podman_desktop:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Build of Podman Desktop",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:podman_desktop:0"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Build of Podman Desktop - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "unaffected",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "unaffected",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "unaffected",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Trusted Artifact Signer",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-22T13:22:38.873Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T12:05:46.721Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-9277"
          },
          {
            "name": "RHBZ#2480741",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34342"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26234"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29197"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34791"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29834"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29795"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26072"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26077"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26079"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26090"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26080"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33683"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30076"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28571"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26225"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26234: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29197: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34791: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29834: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29795: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26072: Red Hat OpenShift Service Mesh 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26077: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26079: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26090: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26080: Red Hat OpenShift Service Mesh 3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33683: Red Hat Quay 3.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30076: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28571: Red Hat Quay 3.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26225: Red Hat Satellite 6.18"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-22T14:01:14.427Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-22T13:22:38.873Z",
            "value": "Made public."
          }
        ],
        "title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.npmjs.com/package/shell-quote",
          "defaultStatus": "unaffected",
          "packageName": "shell-quote",
          "product": "shell-quote",
          "programFiles": [
            "quote.js"
          ],
          "repo": "https://github.com/ljharb/shell-quote",
          "versions": [
            {
              "lessThan": "1.8.4",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Akshat Sinha (@akshatgit)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jordan Harband (@ljharb)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eshell-quote\u0027s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: \u0027...\\n...\u0027 }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser\u0027s control-operator allowlist; `{ op: \u0027glob\u0027, pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.\u003c/p\u003e"
            }
          ],
          "value": "shell-quote\u0027s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: \u0027...\\n...\u0027 }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser\u0027s control-operator allowlist; `{ op: \u0027glob\u0027, pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T13:22:38.873Z",
        "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "shortName": "harborist"
      },
      "references": [
        {
          "name": "GHSA-w7jw-789q-3m8p",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/shell-quote/commit/1518179"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ljharb/shell-quote"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.npmjs.com/package/shell-quote"
        }
      ],
      "source": {
        "advisory": "GHSA-w7jw-789q-3m8p",
        "discovery": "EXTERNAL"
      },
      "title": "shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
    "assignerShortName": "harborist",
    "cveId": "CVE-2026-9277",
    "datePublished": "2026-05-22T13:22:38.873Z",
    "dateReserved": "2026-05-22T12:13:25.893Z",
    "dateUpdated": "2026-07-10T12:05:46.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:26072

CVE-2026-9277 (GCVE-0-2026-9277)

Tags

Sightings

Nomenclature