CVE-2026-9277: Red Hat Cluster Observability Operator 1.5.0
High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.
Affected products
- Red Hat Cluster Observability Operator 1.5.0: before 1782840519 (fixed in 1782840519); before 1782839981 (fixed in 1782839981); before 1782839193 (fixed in 1782839193); before 1782838753 (fixed in 1782838753); before 1782839279 (fixed in 1782839279); before 1782840539 (fixed in 1782840539); …
- Red Hat Cryostat 4
- Red Hat Cryostat 4 On Rhel 9: before 4.2.0-10 (fixed in 4.2.0-10)
- Red Hat Gatekeeper 3
- Red Hat Node Healthcheck Operator
- Red Hat Openshift Lightspeed
- Red Hat Openshift Pipelines
- Red Hat Openshift Service Mesh 3
- Red Hat Red Hat Amq Broker 7
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform 2.1: before 1785854226 (fixed in 1785854226)
- Red Hat Red Hat Build Of Apache Camel - Hawtio 4
- Red Hat Red Hat Build Of Podman Desktop
- Red Hat Red Hat Build Of Podman Desktop - Tech Preview
- Red Hat Red Hat Data Grid 8
- Red Hat Red Hat Developer Hub 1.10: before 1783448184 (fixed in 1783448184)
- Red Hat Red Hat Developer Hub 1.9: before 1782761244 (fixed in 1782761244)
- Red Hat Red Hat Discovery 2: before 1782166952 (fixed in 1782166952)
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux Ai Rhel Ai 3
- Red Hat Red Hat Fuse 7
- Red Hat Red Hat Migration Toolkit 1.8: before 1783690532 (fixed in 1783690532)
- Red Hat Red Hat Openshift Ai Rhoai
- and 23 more
Published 2026-05-22. Last modified 2026-09-14.