Hi,

The following vulnerability was published for node-shell-quote.

CVE-2026-102422[0]:
| shell-quote's `quote()` function emits a `{ comment }` token as `#`
| followed by its text, which comments out the rest of the shell line,
| including the opening quote of any later string token. A line
| terminator (\n, \r, U+2028, U+2029) in that later string therefore
| ends the comment, and the rest of the string is parsed as shell
| input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs
| `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token
| for a `#` in the middle of a word (for example
| `http://example.com/#frag`), so callers that combine `parse()`
| output with another untrusted string, such as
| `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected.
| The fix for CVE-2026-9277 rejected line terminators in the comment's
| own text, but not in the tokens after it. Fixed in 1.11.0: `quote()`
| throws a `TypeError` when a string after a `{ comment }` token
| contains a line terminator.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102422
https://www.cve.org/CVERecord?id=CVE-2026-102422
[1] https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv
[2] https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1149713 in node-shell-quote reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-shell-quote/-/commit/5b810921dea820f5fdaac6207cea90ae3142ff18

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149713

Hello,

Bug #1149713 in node-shell-quote reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-shell-quote/-/commit/5b810921dea820f5fdaac6207cea90ae3142ff18

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149713

Le 02/10/2026 à 16:51, Salvatore Bonaccorso a écrit :

Hi,

here is the debdiff. If you don't consider it as urgent, of course I can
push it to release.debian.org.

Best regards,
Xavier

Hello,

Bug #1149713 in node-shell-quote reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-shell-quote/-/commit/c95120db96de894e828de4c92e39913945cfead3

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149713

We believe that the bug you reported is fixed in the latest version of
node-shell-quote, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149713@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-shell-quote package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 03 Oct 2026 07:36:07 +0200
Source: node-shell-quote
Architecture: source
Version: 1.12.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1149713
Changes:
 node-shell-quote (1.12.0-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version (Closes: #1149713, CVE-2026-102422)
Checksums-Sha1:
 92fb73ae6b036f5dcc308a51769596064d16e333 2097 node-shell-quote_1.12.0-1.dsc
 768c44f13ddab55a2967cb739556e2fc68563c38 32936 node-shell-quote_1.12.0.orig.tar.gz
 542c15e673272646fb82bb03ad1bf0f26ac7bfec 3152 node-shell-quote_1.12.0-1.debian.tar.xz
Checksums-Sha256:
 2f5d78e08835ee541bb9d80d53967d32f8e59e6e0e5e9370d3734d8c70af1f6b 2097 node-shell-quote_1.12.0-1.dsc
 615d46e99b0ea9d6ba73ecc19b6920962100f8053b06ec892b9623e19cbe451f 32936 node-shell-quote_1.12.0.orig.tar.gz
 542e393fdd051601df04d9a0c2ccf89cb2176d388ffbc05dd87118b7693c5569 3152 node-shell-quote_1.12.0-1.debian.tar.xz
Files:
 a81954f3f2e301b555b01e287e189930 2097 javascript optional node-shell-quote_1.12.0-1.dsc
 31c5a09b3aeb0df8a6b8782ae4e9050b 32936 javascript optional node-shell-quote_1.12.0.orig.tar.gz
 69cebb818dc5c5ec1bbe586d0e44184e 3152 javascript optional node-shell-quote_1.12.0-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrAlH0ACgkQ9tdMp8mZ
7um0QBAAgQVyXosHnSgLCYimKr/WSuyhGLv1lEZMHebcAcPZrZQrefEVu3os7v1Q
Oo4skziREgQI9TAQlDQ7aYzhzpjVAmPF/kAETYaDNvl0drXoKzqfcvuXOgtP9ock
0hCfGRWIEVyzVtNVtj1O1GgXq3xup4263idy/HZHHNnrZ7BfBYPtdUNXWoY/N2ky
DPVhmlWLCEU2A9Utmitmpi4N8zYc7GOa3gCG8aiCc2Vv22q8RVQEZPP2HCxWSha4
oJ73s4XMuqssxV1un91P5mpp7Ctd1DBV9kTTe+4ePixGqq9PURJtrOjhVIZOPPeI
U2Duv6wU6M1zeafjT671RWqzvcSMU9/GQPcd2rFrhwEP7k4Gf6oeSKbyeV3BdHQ/
pkXi9Y/YUqQmP4kJk58OBGvmyVoyCha3aT+NRvXzCB/rtnBHqf0c7TZ1KQJAqupf
MTqUK8v3V4eFh9d1GhacDBGU+IHaB/7xr4PfSRCTKOb6G+2xaUXLHQPS9JK3DFgS
VgWwz4QUK1u9fRkjkZiq35IXs/xlZVNdAT8ZrurHabG+S5xv8eBcZ7w3SxeCkexG
AxDWos9stNJiZ4RqvkG6OM78XJh8mqWzU5y0xIOUe/QUmujmrn77gZIJ5jJpkorM
gX9c3gWDZyUN/h0Y8TMbLdcUA4XTGJ2faQC7xEp+bej3t/2M7OQ=
=6q1L
-----END PGP SIGNATURE-----

Hi Xavier,

We have node-shell-quote ineed in dsa-needed list, and issue
warranting a DSA. But while at it, can you as well include the fix for
the no-dsa marked one, CVE-2026-13311? Or is there a reason we should
rather ignore it?

Regards,
Salvatore

Le 05/10/2026 à 11:27, Salvatore Bonaccorso a écrit :

Hi,

done. I also fixed the debdiff, base was not good

Hi Xavier,

Indeed, that was wrong base as we already have 1.7.4+~1.7.1-1+deb13u1.

Target distribution should be trixie-security instead. With that
fixed, please upload to security-master.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
node-shell-quote, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149713@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-shell-quote package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 06 Oct 2026 11:29:23 +0200
Source: node-shell-quote
Binary: node-shell-quote
Architecture: source all
Version: 1.7.4+~1.7.1-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Description:
 node-shell-quote - quote and parse shell commands
Closes: 1140921 1149713
Changes:
 node-shell-quote (1.7.4+~1.7.1-1+deb13u2) trixie-security; urgency=medium
 .
   * Team upload
   * Reject line terminators in tokens after a comment
     (Closes: #1149713, CVE-2026-102422)
   * Finalize parse tokens in linear time (Closes: #1140921, CVE-2026-13311)
Checksums-Sha1:
 d624fa6b3e79ba505373d3b5b656a464587a97a2 2508 node-shell-quote_1.7.4+~1.7.1-1+deb13u2.dsc
 2d059091214a02c29f003f591032172b2aff77e8 2241 node-shell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz
 526309c375cb6d9dff84f04d6bf6cb21038339db 15359 node-shell-quote_1.7.4+~1.7.1.orig.tar.gz
 0701418069953755f62d07373d3f37791846370a 6836 node-shell-quote_1.7.4+~1.7.1-1+deb13u2.debian.tar.xz
 c9e2ad8ea36fc34a06b53eb01337dc0a63e3a976 15432 node-shell-quote_1.7.4+~1.7.1-1+deb13u2_all.deb
 27d2f749e95eed643e517e57e876d442e1d53c51 15839 node-shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo
Checksums-Sha256:
 4d46dadf65a436b75babf9eacd9c731e4b017e8001c3c96693397478cd906737 2508 node-shell-quote_1.7.4+~1.7.1-1+deb13u2.dsc
 732c849a97ba0778c6bd224b09895b95f7ba0bcdeb41658dfbefbd6fcb48c42d 2241 node-shell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz
 c47d07f375e52ef8c5b27382a9fdc0018e1a50954a3480b13fc96c8bb0314967 15359 node-shell-quote_1.7.4+~1.7.1.orig.tar.gz
 df1f9e73127e331cee3d852080d54ea3c04fe98f00a578eaa3736b1806c6d866 6836 node-shell-quote_1.7.4+~1.7.1-1+deb13u2.debian.tar.xz
 873ff44532e895891919d7868321f87160658e71d6e729d0f16d002037940f3a 15432 node-shell-quote_1.7.4+~1.7.1-1+deb13u2_all.deb
 3058814d9e18f2a2f67c94357876b3bff78599ef7052f09a7123e24bd44f1156 15839 node-shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo
Files:
 9957de293c9084c211dc07b1453f6690 2508 javascript optional node-shell-quote_1.7.4+~1.7.1-1+deb13u2.dsc
 c932ae6cdd4e3244131b099713a03457 2241 javascript optional node-shell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz
 7af11564f75bafc25260ad455fb2a0b9 15359 javascript optional node-shell-quote_1.7.4+~1.7.1.orig.tar.gz
 ec0abcb997a15c5de0ba7265ce325c06 6836 javascript optional node-shell-quote_1.7.4+~1.7.1-1+deb13u2.debian.tar.xz
 5226927e8759a676d84a405751a68374 15432 javascript optional node-shell-quote_1.7.4+~1.7.1-1+deb13u2_all.deb
 010518e6c4b209c2e63f219a02be9d2a 15839 javascript optional node-shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrExU4ACgkQ9tdMp8mZ
7um/pA//RzYgLFbh8RgWUDkjzPKmtucBMKOfLzHBS3wanCbfhOwCYUYpYTB7fxiQ
yomO96TZJr767TTE6CrIC7/gTZ8L6ck0+kfrQ9Umt2m/uvk9zIw3STIM4zfvGidY
C4tv8+o+ne3dCj1fj/LzRWmn079Q5iZavEUYKu4cqpY3baoJ4l2QA8J73OYdeUgk
YiBobFNhvcO5/EyKCmMCkHk8myRYOU+NmMZGsIDyd124INN/JdOKAz4fNbhuv261
p3Wdrnc+CS9gTMeevspo50jsxSaN4QCR3lSobEdDiAlJjEiw3nXLx+PSKM0ZayoV
3tKcbqRhCla88T04fuOjeAAo667+F5iBj47OcMjGH+SmHv6WiC/BvjKLWWU+yAsc
yZ9jHOOXzo5cxuvqJHAFlTdsdzjNQduAiKSp6Gg7JenRfL5Jz3dgKREUR77nrNUi
i8hNFZB/yozlxAA+iXB85ZExzgxN7sfFZk3UcD0oax7zd3X+gqI2vcbBhqliQ6us
7IeWo6iUkTfiiWu3QDY0OGoQtDKcDzH1slz6qcvHAc4kCt+uhcv4QVAr4nO85ptH
+sgvBAaKDyYLFX8VlNStuSd01eM3CVojnIBxlPdmUNSavkoOiBx6C3sEdmauhssf
FzKowVPeJHeB6ssaMzZbFHNnWyDqvwInApmau7O9cXky7Kjvfuo=
=wAgI
-----END PGP SIGNATURE-----