[SECURITY] [DSA 6300-1] node-shell-quote security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6300-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 26, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : node-shell-quote
CVE ID : CVE-2026-9277
Akshat Sinha discovered that incorrect input sanitising in
node-shell-quote, a Node.js module to quote and parse shell commands,
could result in shell command injection.
For the oldstable distribution (bookworm), this problem has been fixed
in version 1.7.4+~1.7.1-1+deb12u1.
For the stable distribution (trixie), this problem has been fixed in
version 1.7.4+~1.7.1-1+deb13u1.
We recommend that you upgrade your node-shell-quote packages.
For the detailed security status of node-shell-quote please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/node-shell-quote
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmoWC/EACgkQEMKTtsN8
TjYv8BAAmKNyteqbTr6ewekE6O+qc81n4Nc84VZe4E57hZNWl8SsYZItrygtrAeJ
0gIZk1+veTJc9Gg5Bn7IoWtMy36KZfRAoqLTkPKXd6bIO2JCGizqiYU1UDVEcQd/
ZgbKqd206oA9MSb2n+s9Y912gOHKbcLsVgosrylKRgj+fPgz/iuGBntxviedyXDj
u5zYd6LiXm9PIF+Pn+NMtdJkls4DXlTwUUEGBi/0pNClu4054ypyDK8gMwxANih6
PzhLAXctHUXlkDG5dBjVwhcerwcuPyNP+cFT2FypMS2pRljowGhfaZS2Py+4fA4H
W+aNqemfMhk5DnTHUzkk/W7AAWtDOSuD/wk5W1aSEUHFoV7Ryg20pGMLK229sBW6
UiZWYkinOcXUKCXBiwowArGzVW39o8yBXz7bpRzM+mMiP7+AOlwIC/ccLIL7gMZj
nporpqN8u7TTzetBJc1PgWQCHpwVWvlvePjEDXSMF4yQsN9u+ss0pzMbX4UnQCVD
iP69x/Zonmoez8ixcsdJva9lPBglS4GXnVcXoVrzE/FK7G8Eflw1f1RqAc1KFO+U
LN3EECNQbFvGyYJRuBFauF5xE8oEIlUbGpo2hyNdS6xIzPhEP72DVOzdE5skUkUd
N22Zd81TgYJDkH4PiinNROE0qlrfh+w6qxt/xcZ46tYu6SGflD4=
=w4zw
-----END PGP SIGNATURE-----
Reply to: