{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-9277", "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "state": "PUBLISHED", "assignerShortName": "harborist", "dateReserved": "2026-05-22T12:13:25.893Z", "datePublished": "2026-05-22T13:22:38.873Z", "dateUpdated": "2026-09-04T12:04:46.059Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "shortName": "harborist", "dateUpdated": "2026-05-22T13:22:38.873Z" }, "title": "shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE" } ] }, { "descriptions": [ { "lang": "en", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE" } ] } ], "affected": [ { "product": "shell-quote", "collectionURL": "https://www.npmjs.com/package/shell-quote", "packageName": "shell-quote", "repo": "https://github.com/ljharb/shell-quote", "programFiles": [ "quote.js" ], "versions": [ { "status": "affected", "version": "1.1.0", "lessThan": "1.8.4", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\\n, \\r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

" } ] } ], "references": [ { "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p", "name": "GHSA-w7jw-789q-3m8p", "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/ljharb/shell-quote/commit/1518179", "name": "Fix commit", "tags": [ "patch" ] }, { "url": "https://github.com/ljharb/shell-quote", "tags": [ "product" ] }, { "url": "https://www.npmjs.com/package/shell-quote", "tags": [ "product" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } }, { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } } ], "credits": [ { "lang": "en", "value": "Akshat Sinha (@akshatgit)", "type": "finder" }, { "lang": "en", "value": "Jordan Harband (@ljharb)", "type": "remediation developer" } ], "source": { "advisory": "GHSA-w7jw-789q-3m8p", "discovery": "EXTERNAL" } }, "adp": [ { "references": [ { "url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p", "tags": [ "exploit" ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-05-22T14:17:31.964845Z", "id": "CVE-2026-9277", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T14:17:39.549Z" } }, { "title": "CVE Program Container", "references": [ { "url": "http://www.openwall.com/lists/oss-security/2026/05/23/2" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-23T03:04:40.537Z" } }, { "affected": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cryostat:4::el9" ], "defaultStatus": "affected", "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "4.2.0-10", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782840519", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782839981", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782839193", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782838753", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782839279", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782840539", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/logging-console-plugin-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782841925", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/monitoring-console-plugin-pf5-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782844225", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/monitoring-console-plugin-pf6-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782839658", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/monitoring-console-plugin-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782838476", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782839996", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:cluster_observability_operator:1.5::el9" ], "defaultStatus": "affected", "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782839494", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhdh:1.10::el9" ], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.10", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1783448184", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhdh:1.9::el9" ], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782761244", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:discovery:2::el9" ], "defaultStatus": "affected", "packageName": "discovery/discovery-ui-rhel9", "product": "Red Hat Discovery 2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782166952", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:rhmt:1.8::el8" ], "defaultStatus": "affected", "packageName": "rhmtc/openshift-migration-ui-rhel8", "product": "Red Hat Migration Toolkit 1.8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1783690532", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.15::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console", "product": "Red Hat OpenShift Container Platform 4.15", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787028559", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.16::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.16", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787054159", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.17::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.17", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787631382", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.18::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.18", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1785278569", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.19::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.19", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1783718157", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.20::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.20", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782911711", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.20::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-agent-installer-ui-rhel9", "product": "Red Hat OpenShift Container Platform 4.20", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1784724699", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.21::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.21", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782308675", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.21::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-agent-installer-ui-rhel9", "product": "Red Hat OpenShift Container Platform 4.21", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1784713741", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.22::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.22", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782224390", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift:4.22::el9" ], "defaultStatus": "affected", "packageName": "openshift4/ose-agent-installer-ui-rhel9", "product": "Red Hat OpenShift Container Platform 4.22", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1784721581", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:openshift_devspaces:3.30::el9" ], "defaultStatus": "affected", "packageName": "devspaces/code-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.30", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1787762793", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:2.6::el8" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-ossmc-rhel8", "product": "Red Hat OpenShift Service Mesh 2.6", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780907585", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:2.6::el8" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-rhel8", "product": "Red Hat OpenShift Service Mesh 2.6", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780916536", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.0::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-ossmc-rhel9", "product": "Red Hat OpenShift Service Mesh 3.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780470245", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.0::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-rhel9", "product": "Red Hat OpenShift Service Mesh 3.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780916345", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.1::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-ossmc-rhel9", "product": "Red Hat OpenShift Service Mesh 3.1", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780470706", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.1::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-rhel9", "product": "Red Hat OpenShift Service Mesh 3.1", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780916478", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.2::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-ossmc-rhel9", "product": "Red Hat OpenShift Service Mesh 3.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780470003", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.2::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-rhel9", "product": "Red Hat OpenShift Service Mesh 3.2", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780916392", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.3::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-ossmc-rhel9", "product": "Red Hat OpenShift Service Mesh 3.3", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780997382", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:service_mesh:3.3::el9" ], "defaultStatus": "affected", "packageName": "openshift-service-mesh/kiali-rhel9", "product": "Red Hat OpenShift Service Mesh 3.3", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1780997438", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:quay:3.10::el8" ], "defaultStatus": "affected", "packageName": "quay/quay-rhel8", "product": "Red Hat Quay 3.1", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1782487717", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:quay:3.12::el8" ], "defaultStatus": "affected", "packageName": "quay/quay-rhel8", "product": "Red Hat Quay 3.12", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1781937357", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:quay:3.15::el8" ], "defaultStatus": "affected", "packageName": "quay/quay-rhel8", "product": "Red Hat Quay 3.15", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1784351966", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:quay:3.16::el9" ], "defaultStatus": "affected", "packageName": "quay/quay-rhel9", "product": "Red Hat Quay 3.16", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1783955846", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:quay:3.9::el8" ], "defaultStatus": "affected", "packageName": "quay/quay-rhel8", "product": "Red Hat Quay 3.9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1781878070", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:satellite:6.18::el9" ], "defaultStatus": "affected", "packageName": "satellite/iop-vulnerability-frontend-rhel9", "product": "Red Hat Satellite 6.18", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1781032495", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:ansible_portal:2.1" ], "defaultStatus": "affected", "packageName": "ansible-automation-platform/automation-portal", "product": "Self-service automation portal 2.1", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1785854226", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:cryostat:4" ], "defaultStatus": "unaffected", "packageName": "shell-quote", "product": "Cryostat 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:gatekeeper:3" ], "defaultStatus": "unaffected", "packageName": "gatekeeper/gatekeeper-rhel9", "product": "Gatekeeper 3", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:workload_availability_nhc:0" ], "defaultStatus": "unaffected", "packageName": "workload-availability/node-healthcheck-must-gather-rhel9", "product": "Node HealthCheck Operator", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:workload_availability_nhc:0" ], "defaultStatus": "unaffected", "packageName": "workload-availability/node-healthcheck-operator-bundle", "product": "Node HealthCheck Operator", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:workload_availability_nhc:0" ], "defaultStatus": "unaffected", "packageName": "workload-availability/node-healthcheck-rhel9-operator", "product": "Node HealthCheck Operator", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_lightspeed" ], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-console-plugin-419-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_lightspeed" ], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_lightspeed" ], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-console-plugin-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_pipelines:1" ], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_pipelines:1" ], "defaultStatus": "unaffected", "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_pipelines:1" ], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-hub-ui-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_pipelines:1" ], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-hub-ui-rhel9", "product": "OpenShift Pipelines", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:service_mesh:3" ], "defaultStatus": "unaffected", "packageName": "openshift-service-mesh/kiali-operator-bundle", "product": "OpenShift Service Mesh 3", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:service_mesh:3" ], "defaultStatus": "unaffected", "packageName": "openshift-service-mesh/kiali-rhel9-operator", "product": "OpenShift Service Mesh 3", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:amq_broker:7" ], "defaultStatus": "unaffected", "packageName": "shell-quote", "product": "Red Hat AMQ Broker 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ], "defaultStatus": "affected", "packageName": "ansible-automation-platform-24/lightspeed-rhel8", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ], "defaultStatus": "affected", "packageName": "ansible-automation-platform-25/lightspeed-rhel8", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ], "defaultStatus": "unaffected", "packageName": "ansible-automation-platform-26/gateway-rhel9", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ], "defaultStatus": "affected", "packageName": "ansible-automation-platform-26/lightspeed-rhel9", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ], "defaultStatus": "unaffected", "packageName": "automation-eda-controller", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ], "defaultStatus": "unaffected", "packageName": "automation-gateway", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ], "defaultStatus": "unaffected", "packageName": "automation-platform-ui", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:apache_camel_hawtio:4" ], "defaultStatus": "unaffected", "packageName": "shell-quote", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:podman_desktop:1" ], "defaultStatus": "affected", "packageName": "rh-podman-desktop.git", "product": "Red Hat Build of Podman Desktop", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:podman_desktop:0" ], "defaultStatus": "affected", "packageName": "rhdesktop/rh-podman-desktop-ext-bootc-rhel10", "product": "Red Hat Build of Podman Desktop - Tech Preview", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:jboss_data_grid:8" ], "defaultStatus": "unaffected", "packageName": "shell-quote", "product": "Red Hat Data Grid 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:10" ], "defaultStatus": "unaffected", "packageName": "goose", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "unaffected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "unaffected", "packageName": "pcs", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "unaffected", "packageName": "goose", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "grafana", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "unaffected", "packageName": "pcs", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-gaudi-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3" ], "defaultStatus": "affected", "packageName": "rhelai3/bootc-rocm-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:3" ], "defaultStatus": "affected", "packageName": "rhelai3/disk-image-cuda-rhel9", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:jboss_fuse:7" ], "defaultStatus": "affected", "packageName": "shell-quote", "product": "Red Hat Fuse 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-dashboard-rhel8", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mlflow-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mod-arch-automl-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mod-arch-autorag-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mod-arch-maas-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mod-arch-mlflow-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_ai" ], "defaultStatus": "unaffected", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:container_native_virtualization:4" ], "defaultStatus": "affected", "packageName": "container-native-virtualization/kubevirt-console-plugin-rhel9", "product": "Red Hat OpenShift Virtualization 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:trusted_artifact_signer:1" ], "defaultStatus": "unaffected", "packageName": "rhtas/rekor-search-ui-rhel9", "product": "Red Hat Trusted Artifact Signer", "vendor": "Red Hat" } ], "datePublic": "2026-05-22T13:22:38.873Z", "descriptions": [ { "lang": "en", "value": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-78", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE" } ] } ], "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2026-9277" }, { "name": "RHBZ#2480741", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741" }, { "tags": [ "x_sadp-csaf-vex" ], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9277.json" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:28010" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:34342" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:36754" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:33574" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:41928" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:56912" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:56854" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:60023" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:48699" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:40765" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:44263" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:34791" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:44267" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:29834" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:44237" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:29795" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:26072" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:26080" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:26077" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:26079" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:26090" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:30076" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:33683" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:28571" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:26225" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:50850" } ], "solutions": [ { "lang": "en", "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9" }, { "lang": "en", "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0" }, { "lang": "en", "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10" }, { "lang": "en", "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9" }, { "lang": "en", "value": "RHSA-2026:29197: Red Hat Discovery 2" }, { "lang": "en", "value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8" }, { "lang": "en", "value": "RHSA-2026:56912: Red Hat OpenShift Container Platform 4.15" }, { "lang": "en", "value": "RHSA-2026:56854: Red Hat OpenShift Container Platform 4.16" }, { "lang": "en", "value": "RHSA-2026:60023: Red Hat OpenShift Container Platform 4.17" }, { "lang": "en", "value": "RHSA-2026:48699: Red Hat OpenShift Container Platform 4.18" }, { "lang": "en", "value": "RHSA-2026:40765: Red Hat OpenShift Container Platform 4.19" }, { "lang": "en", "value": "RHSA-2026:44263: Red Hat OpenShift Container Platform 4.20" }, { "lang": "en", "value": "RHSA-2026:34791: Red Hat OpenShift Container Platform 4.20" }, { "lang": "en", "value": "RHSA-2026:44267: Red Hat OpenShift Container Platform 4.21" }, { "lang": "en", "value": "RHSA-2026:29834: Red Hat OpenShift Container Platform 4.21" }, { "lang": "en", "value": "RHSA-2026:44237: Red Hat OpenShift Container Platform 4.22" }, { "lang": "en", "value": "RHSA-2026:29795: Red Hat OpenShift Container Platform 4.22" }, { "lang": "en", "value": "RHSA-2026:62260: Red Hat OpenShift Dev Spaces 3.30" }, { "lang": "en", "value": "RHSA-2026:26072: Red Hat OpenShift Service Mesh 2.6" }, { "lang": "en", "value": "RHSA-2026:26080: Red Hat OpenShift Service Mesh 3.0" }, { "lang": "en", "value": "RHSA-2026:26077: Red Hat OpenShift Service Mesh 3.1" }, { "lang": "en", "value": "RHSA-2026:26079: Red Hat OpenShift Service Mesh 3.2" }, { "lang": "en", "value": "RHSA-2026:26090: Red Hat OpenShift Service Mesh 3.3" }, { "lang": "en", "value": "RHSA-2026:30076: Red Hat Quay 3.12" }, { "lang": "en", "value": "RHSA-2026:42796: Red Hat Quay 3.15" }, { "lang": "en", "value": "RHSA-2026:41066: Red Hat Quay 3.16" }, { "lang": "en", "value": "RHSA-2026:33683: Red Hat Quay 3.1" }, { "lang": "en", "value": "RHSA-2026:28571: Red Hat Quay 3.9" }, { "lang": "en", "value": "RHSA-2026:26225: Red Hat Satellite 6.18" }, { "lang": "en", "value": "RHSA-2026:50850: Self-service automation portal 2.1" } ], "timeline": [ { "lang": "en", "time": "2026-05-22T14:01:14.427Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-05-22T13:22:38.873Z", "value": "Made public." } ], "title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators", "x_adpType": "supplier", "x_generator": { "engine": "sadp-cli 1.0.0" }, "providerMetadata": { "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-04T12:04:46.059Z" } } ] } }