fix: upgrade shell-quote to 1.8.4 (CVE-2026-9277) - #57663
Conversation
|
Hi @anupamme! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
|
Warning Missing Test Plan Please add a "## Test Plan" section to your PR description. A Test Plan lets us know how these changes were tested. |
meta-cla
Bot
added
the
CLA Signed
|
Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks! |
facebook-github-tools
Bot
added
the
Shared with Meta
| "fast-uri": "^3.1.2" | ||
| }, | ||
| "dependencies": { | ||
| "shell-quote": "1.8.4" |
There was a problem hiding this comment.
This should be added in the resolution block
ea0ec4f to
68950a9
Compare
Automated dependency upgrade by OrbisAI Security
68950a9 to
b0e4f74
Compare
2 participants
Summary
Upgrade shell-quote from 1.8.2 to 1.8.4 to fix CVE-2026-9277.
Vulnerability
CVE-2026-9277yarn.lock(dependency:shell-quote)Description: shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
Evidence
Scanner confirmation: trivy rule
CVE-2026-9277flagged this pattern.Changes
package.jsonyarn.lockBehavior Preservation
The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security