Your message dated Sun, 11 Oct 2026 11:52:16 +0000
with message-id <[email protected]>
and subject line Bug#1149713: fixed in node-shell-quote 1.7.4+~1.7.1-1+deb13u2
has caused the Debian Bug report #1149713,
regarding node-shell-quote: CVE-2026-102422
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149713: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149713
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-shell-quote
Version: 1.10.0-1
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security upstream
Hi,
The following vulnerability was published for node-shell-quote.
CVE-2026-102422[0]:
| shell-quote's `quote()` function emits a `{ comment }` token as `#`
| followed by its text, which comments out the rest of the shell line,
| including the opening quote of any later string token. A line
| terminator (\n, \r, U+2028, U+2029) in that later string therefore
| ends the comment, and the rest of the string is parsed as shell
| input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs
| `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token
| for a `#` in the middle of a word (for example
| `http://example.com/#frag`), so callers that combine `parse()`
| output with another untrusted string, such as
| `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected.
| The fix for CVE-2026-9277 rejected line terminators in the comment's
| own text, but not in the tokens after it. Fixed in 1.11.0: `quote()`
| throws a `TypeError` when a string after a `{ comment }` token
| contains a line terminator.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-102422
https://www.cve.org/CVERecord?id=CVE-2026-102422
[1]
https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv
[2]
https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-shell-quote
Source-Version: 1.7.4+~1.7.1-1+deb13u2
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-shell-quote, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-shell-quote package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 06 Oct 2026 11:29:23 +0200
Source: node-shell-quote
Binary: node-shell-quote
Architecture: source all
Version: 1.7.4+~1.7.1-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Description:
node-shell-quote - quote and parse shell commands
Closes: 1140921 1149713
Changes:
node-shell-quote (1.7.4+~1.7.1-1+deb13u2) trixie-security; urgency=medium
.
* Team upload
* Reject line terminators in tokens after a comment
(Closes: #1149713, CVE-2026-102422)
* Finalize parse tokens in linear time (Closes: #1140921, CVE-2026-13311)
Checksums-Sha1:
d624fa6b3e79ba505373d3b5b656a464587a97a2 2508
node-shell-quote_1.7.4+~1.7.1-1+deb13u2.dsc
2d059091214a02c29f003f591032172b2aff77e8 2241
node-shell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz
526309c375cb6d9dff84f04d6bf6cb21038339db 15359
node-shell-quote_1.7.4+~1.7.1.orig.tar.gz
0701418069953755f62d07373d3f37791846370a 6836
node-shell-quote_1.7.4+~1.7.1-1+deb13u2.debian.tar.xz
c9e2ad8ea36fc34a06b53eb01337dc0a63e3a976 15432
node-shell-quote_1.7.4+~1.7.1-1+deb13u2_all.deb
27d2f749e95eed643e517e57e876d442e1d53c51 15839
node-shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo
Checksums-Sha256:
4d46dadf65a436b75babf9eacd9c731e4b017e8001c3c96693397478cd906737 2508
node-shell-quote_1.7.4+~1.7.1-1+deb13u2.dsc
732c849a97ba0778c6bd224b09895b95f7ba0bcdeb41658dfbefbd6fcb48c42d 2241
node-shell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz
c47d07f375e52ef8c5b27382a9fdc0018e1a50954a3480b13fc96c8bb0314967 15359
node-shell-quote_1.7.4+~1.7.1.orig.tar.gz
df1f9e73127e331cee3d852080d54ea3c04fe98f00a578eaa3736b1806c6d866 6836
node-shell-quote_1.7.4+~1.7.1-1+deb13u2.debian.tar.xz
873ff44532e895891919d7868321f87160658e71d6e729d0f16d002037940f3a 15432
node-shell-quote_1.7.4+~1.7.1-1+deb13u2_all.deb
3058814d9e18f2a2f67c94357876b3bff78599ef7052f09a7123e24bd44f1156 15839
node-shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo
Files:
9957de293c9084c211dc07b1453f6690 2508 javascript optional
node-shell-quote_1.7.4+~1.7.1-1+deb13u2.dsc
c932ae6cdd4e3244131b099713a03457 2241 javascript optional
node-shell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz
7af11564f75bafc25260ad455fb2a0b9 15359 javascript optional
node-shell-quote_1.7.4+~1.7.1.orig.tar.gz
ec0abcb997a15c5de0ba7265ce325c06 6836 javascript optional
node-shell-quote_1.7.4+~1.7.1-1+deb13u2.debian.tar.xz
5226927e8759a676d84a405751a68374 15432 javascript optional
node-shell-quote_1.7.4+~1.7.1-1+deb13u2_all.deb
010518e6c4b209c2e63f219a02be9d2a 15839 javascript optional
node-shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrExU4ACgkQ9tdMp8mZ
7um/pA//RzYgLFbh8RgWUDkjzPKmtucBMKOfLzHBS3wanCbfhOwCYUYpYTB7fxiQ
yomO96TZJr767TTE6CrIC7/gTZ8L6ck0+kfrQ9Umt2m/uvk9zIw3STIM4zfvGidY
C4tv8+o+ne3dCj1fj/LzRWmn079Q5iZavEUYKu4cqpY3baoJ4l2QA8J73OYdeUgk
YiBobFNhvcO5/EyKCmMCkHk8myRYOU+NmMZGsIDyd124INN/JdOKAz4fNbhuv261
p3Wdrnc+CS9gTMeevspo50jsxSaN4QCR3lSobEdDiAlJjEiw3nXLx+PSKM0ZayoV
3tKcbqRhCla88T04fuOjeAAo667+F5iBj47OcMjGH+SmHv6WiC/BvjKLWWU+yAsc
yZ9jHOOXzo5cxuvqJHAFlTdsdzjNQduAiKSp6Gg7JenRfL5Jz3dgKREUR77nrNUi
i8hNFZB/yozlxAA+iXB85ZExzgxN7sfFZk3UcD0oax7zd3X+gqI2vcbBhqliQ6us
7IeWo6iUkTfiiWu3QDY0OGoQtDKcDzH1slz6qcvHAc4kCt+uhcv4QVAr4nO85ptH
+sgvBAaKDyYLFX8VlNStuSd01eM3CVojnIBxlPdmUNSavkoOiBx6C3sEdmauhssf
FzKowVPeJHeB6ssaMzZbFHNnWyDqvwInApmau7O9cXky7Kjvfuo=
=wAgI
-----END PGP SIGNATURE-----
pgp7SfJaV3UML.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
