Le 08/11/2026 à 23:45, Simon Quigley a écrit :
Hello,
I've prepared node-shell-quote 1.7.4+~1.7.1-1+deb12u2 for bookworm-
security, and it's ready for review.
DSA-6548-1 shipped both fixes in node-shell-quote 1.7.4+~1.7.1-1+deb13u2
in Trixie. node-shell-quote 1.12.0-1 in Sid includes the same upstream
commits, 7ff5488599 from 1.9.0 and 6002b2ed90 from 1.11.0. The debdiff
against 1.7.4+~1.7.1-1+deb12u1 is attached, and so is the draft DLA.
- CVE-2026-102422: https://github.com/ljharb/shell-quote/security/
advisories/GHSA-pqg4-j6r4-53mv
- CVE-2026-13311: https://github.com/ljharb/shell-quote/security/
advisories/GHSA-395f-4hp3-45gv
Bookworm's node-shell-quote 1.7.4+~1.7.1-1+deb12u1 includes comment
quoting added by the CVE-2026-9277 fix in DSA-6300-1. Although upstream
lists CVE-2026-102422 as affecting versions from 1.8.4, that earlier
backport makes Bookworm's version vulnerable too. This update makes
quote() throw a TypeError if a string after a comment contains a line
break (\n, \r, U+2028, or U+2029). It also changes the parser to build
its result in a single array, without changing the tokens it returns.
Hi,
looks good to me, thanks!
