https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:37:54 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10980 bdu:2026-10980 https://cve.radiocsirt.org/vuln/bdu:2026-10980 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/cleanstart-2026-gj43492 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2026-9277 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2026-9277 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-gj43492 https://cve.radiocsirt.org/vuln/euvd-2026-367732 EUVD-2026-367732 https://cve.radiocsirt.org/vuln/euvd-2026-367732 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9277 <p>shell-quote&#39;s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: &#39;...\n...&#39; }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser&#39;s control-operator allowlist; `{ op: &#39;glob&#39;, pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.</p> <p>shell-quote&#39;s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: &#39;...\n...&#39; }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser&#39;s control-operator allowlist; `{ op: &#39;glob&#39;, pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9277 https://cve.radiocsirt.org/vuln/ghsa-w7jw-789q-3m8p <p><strong>Affected:</strong> npm: shell-quote</p> <p>### Summary</p> <p>`shell-quote`&#39;s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (`\n`, `\r`, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal `\n` as a command separator, so any content after it would execute as a second command.</p> <p>The vulnerable code path is reachable in two ways. Neither requires the parser to misbehave — `parse()` only emits ops from a fixed control set — but both are documented API surface:</p> <p>1. **Direct construction.** A caller builds `{ op: &#39;...\n...&#39; }` from external input (e.g. a deserialized argument array) and passes it to `quote()`. 2. **`envFn` return.** `parse(cmd, envFn)` is documented to splice the return value of `envFn` into the result array when it is an object. An attacker-influenced data source consulted by `envFn` can introduce an object token whose `.op` reaches `quote()`.</p> <p>### Impact</p> <p>Shell command injection in callers that pass object tokens with attacker-influenced `.op` values to `quote()` and then hand the result to a shell. The preconditions are narrower than ordinary string injection — they require the caller to feed object tokens into `quote()` — but object tokens are a public, documented part of the API surface, and `quote()` is intended to be a shell-safety boundary.</p> <p>### PoC…</p> <p><strong>Affected:</strong> npm: shell-quote</p> <p>### Summary</p> <p>`shell-quote`&#39;s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (`\n`, `\r`, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal `\n` as a command separator, so any content after it would execute as a second command.</p> <p>The vulnerable code path is reachable in two ways. Neither requires the parser to misbehave — `parse()` only emits ops from a fixed control set — but both are documented API surface:</p> <p>1. **Direct construction.** A caller builds `{ op: &#39;...\n...&#39; }` from external input (e.g. a deserialized argument array) and passes it to `quote()`. 2. **`envFn` return.** `parse(cmd, envFn)` is documented to splice the return value of `envFn` into the result array when it is an object. An attacker-influenced data source consulted by `envFn` can introduce an object token whose `.op` reaches `quote()`.</p> <p>### Impact</p> <p>Shell command injection in callers that pass object tokens with attacker-influenced `.op` values to `quote()` and then hand the result to a shell. The preconditions are narrower than ordinary string injection — they require the caller to feed object tokens into `quote()` — but object tokens are a public, documented part of the API surface, and `quote()` is intended to be a shell-safety boundary.</p> <p>### PoC…</p> https://cve.radiocsirt.org/vuln/ghsa-w7jw-789q-3m8p https://cve.radiocsirt.org/vuln/opensuse-su-2026:10861-1 <p>python311-pytest-html-4.2.0-2.1 on GA media</p> <p>python311-pytest-html-4.2.0-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10861-1 https://cve.radiocsirt.org/vuln/rhsa-2026:26072 <p>shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators</p> <p>shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators</p> https://cve.radiocsirt.org/vuln/rhsa-2026:26072 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9277 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-shell-quote, Ubuntu:Pro:22.04:LTS: node-shell-quote, Ubuntu:24.04:LTS: node-shell-quote, Ubuntu:25.10: node-shell-quote, Ubuntu:Pro:26.04:LTS: node-shell-quote</p> <p>shell-quote&#39;s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: &#39;...\n...&#39; }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser&#39;s control-operator allowlist; `{ op: &#39;glob&#39;, pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-shell-quote, Ubuntu:Pro:22.04:LTS: node-shell-quote, Ubuntu:24.04:LTS: node-shell-quote, Ubuntu:25.10: node-shell-quote, Ubuntu:Pro:26.04:LTS: node-shell-quote</p> <p>shell-quote&#39;s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: &#39;...\n...&#39; }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser&#39;s control-operator allowlist; `{ op: &#39;glob&#39;, pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9277 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1934 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1934