Debian alert DSA-6300-1 (node-shell-quote)

From:
             
 
Moritz Muehlenhoff <jmm@debian.org>
To:
             
 
debian-security-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DSA 6300-1] node-shell-quote security update
Date:
             
 
Tue, 26 May 2026 21:09:57 +0000
Message-ID:
             
 
<ahYMJcAnryojY-13@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6300-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
May 26, 2026                          https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : node-shell-quote
CVE ID         : CVE-2026-9277

Akshat Sinha discovered that incorrect input sanitising in
node-shell-quote, a Node.js module to quote and parse shell commands,
could result in shell command injection.

For the oldstable distribution (bookworm), this problem has been fixed
in version 1.7.4+~1.7.1-1+deb12u1.

For the stable distribution (trixie), this problem has been fixed in
version 1.7.4+~1.7.1-1+deb13u1.

We recommend that you upgrade your node-shell-quote packages.

For the detailed security status of node-shell-quote please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/node-shell-quote

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmoWC/EACgkQEMKTtsN8
TjYv8BAAmKNyteqbTr6ewekE6O+qc81n4Nc84VZe4E57hZNWl8SsYZItrygtrAeJ
0gIZk1+veTJc9Gg5Bn7IoWtMy36KZfRAoqLTkPKXd6bIO2JCGizqiYU1UDVEcQd/
ZgbKqd206oA9MSb2n+s9Y912gOHKbcLsVgosrylKRgj+fPgz/iuGBntxviedyXDj
u5zYd6LiXm9PIF+Pn+NMtdJkls4DXlTwUUEGBi/0pNClu4054ypyDK8gMwxANih6
PzhLAXctHUXlkDG5dBjVwhcerwcuPyNP+cFT2FypMS2pRljowGhfaZS2Py+4fA4H
W+aNqemfMhk5DnTHUzkk/W7AAWtDOSuD/wk5W1aSEUHFoV7Ryg20pGMLK229sBW6
UiZWYkinOcXUKCXBiwowArGzVW39o8yBXz7bpRzM+mMiP7+AOlwIC/ccLIL7gMZj
nporpqN8u7TTzetBJc1PgWQCHpwVWvlvePjEDXSMF4yQsN9u+ss0pzMbX4UnQCVD
iP69x/Zonmoez8ixcsdJva9lPBglS4GXnVcXoVrzE/FK7G8Eflw1f1RqAc1KFO+U
LN3EECNQbFvGyYJRuBFauF5xE8oEIlUbGpo2hyNdS6xIzPhEP72DVOzdE5skUkUd
N22Zd81TgYJDkH4PiinNROE0qlrfh+w6qxt/xcZ46tYu6SGflD4=
=w4zw
-----END PGP SIGNATURE-----