CVE-2026-102422

Published 29 September 2026 · tracked since 29 September 2026

Description

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-102264 LOW 3.5
• CVE-2026-102263 MEDIUM 4.7
• CVE-2026-102414 LOW 3.7
• CVE-2026-102247 MEDIUM 6.8
• CVE-2026-96326 HIGH 7.2
• CVE-2026-101858 MEDIUM 4.7
• CVE-2026-101859 MEDIUM 5.4
• CVE-2026-101860 HIGH 8.8
• CVE-2026-101280 HIGH 7.3
• CVE-2026-101281 HIGH 7.3

→ Open the live CVE board · all tools