CVE-2026-102422

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered, causing any following text on new lines to be executed as shell commands by the underlying system.

This issue is rated Important. Exploitation leads to arbitrary command execution with the privileges of the calling application, but only when that application passes the output of shell-quote's parse(), combined with another attacker-controlled string, to quote() and then runs the result through a shell. Red Hat products ship shell-quote as a bundled npm dependency across several offerings, including RHEL (grafana, grafana-pcp, pcs), Red Hat Ansible Automation Platform, Red Hat OpenShift AI and middleware distributions. Whether a given product is exposed depends on whether its own code reaches quote() with attacker-influenced input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.