Add Socket patch for CVE-2026-9277 in pkg:npm/shell-quote@1.8.3

.socket/blob/cf137993d06cc11c10400f7f9ecc469fae6050e41bf4d5ffd29ed8730b8e7532

@@ -0,0 +1,66 @@
+// Socket Community Patch: https://socket.dev
+// Date: Thu, 23 Jul 2026 16:13:01 GMT
+// For more information see https://socket.dev/patch/7e947070-90ed-4a05-988b-19b2efa7e40f
+// This file includes modifications made by Socket, Inc. on Thu, 23 Jul 2026; these modifications are called the "Patch". In some cases, Socket may be required to make the Patch available to you under specific terms, or may be prohibited from restricting certain rights you may have. For example, the terms of another applicable license may require Socket to make the Patch available under specific terms. In those cases, the Patch is made available to you under the required terms, and Socket does not seek to restrict your rights relative to the Patch where prohibited. In all other cases, the Patch is available to you exclusively under the PolyForm Shield License 1.0.0 (https://polyformproject.org/licenses/shield/1.0.0/). The Patch was distributed by Socket with additional information concerning licensing, attribution, and limitation of liability which may be relevant to you and your use of the Patch. As far as the law allows, the Patch and the software including the patch come as is, without any warranty or condition, and Socket will not be liable to you for any damages arising out of the applicable license terms or the use or nature of the Patch or the software including the patch, under any kind of legal claim.
+
+'use strict';
+
+var OPS = [
+	'||',
+	'&&',
+	';;',
+	'|&',
+	'<(',
+	'<<<',
+	'>>',
+	'>&',
+	'<&',
+	'&',
+	';',
+	'(',
+	')',
+	'|',
+	'<',
+	'>'
+];
+var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+
+module.exports = function quote(xs) {
+	return xs.map(function (s) {
+		if (s === '') {
+			return '\'\'';
+		}
+		if (s && typeof s === 'object') {
+			if (s.op === 'glob') {
+				if (typeof s.pattern !== 'string') {
+					throw new TypeError('glob token requires a string `pattern`');
+				}
+				if (LINE_TERMINATORS.test(s.pattern)) {
+					throw new TypeError('glob `pattern` must not contain line terminators');
+				}
+				return s.pattern.replace(GLOB_SHELL_SPECIAL, '\\$&');
+			}
+			if (typeof s.op === 'string') {
+				if (OPS.indexOf(s.op) < 0) {
+					throw new TypeError('invalid `op` value: ' + JSON.stringify(s.op));
+				}
+				return s.op.replace(/[\s\S]/g, '\\$&');
+			}
+			if (typeof s.comment === 'string') {
+				if (LINE_TERMINATORS.test(s.comment)) {
+					throw new TypeError('`comment` must not contain line terminators');
+				}
+				return '#' + s.comment;
+			}
+			throw new TypeError('unrecognized object token shape');
+		}
+		if ((/["\s\\]/).test(s) && !(/'/).test(s)) {
+			return "'" + s.replace(/(['])/g, '\\$1') + "'";
+		}
+		if ((/["'\s]/).test(s)) {
+			return '"' + s.replace(/(["\\$`!])/g, '\\$1') + '"';
+		}
+		return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g, '$1\\$2');
+	}).join(' ');
+};

.socket/manifest.json

@@ -0,0 +1,27 @@
+{
+  "patches": {
+    "pkg:npm/shell-quote@1.8.3": {
+      "uuid": "7e947070-90ed-4a05-988b-19b2efa7e40f",
+      "exportedAt": "Thu, 23 Jul 2026 16:13:01 GMT",
+      "files": {
+        "quote.js": {
+          "beforeHash": "2d2f2a9cc9c6c6f8960bc45c90cb8d22ff878b1cf3a2ca249f22b2076acb5cd3",
+          "afterHash": "cf137993d06cc11c10400f7f9ecc469fae6050e41bf4d5ffd29ed8730b8e7532"
+        }
+      },
+      "vulnerabilities": {
+        "GHSA-w7jw-789q-3m8p": {
+          "cves": [
+            "CVE-2026-9277"
+          ],
+          "summary": "shell-quote quote() does not escape newlines in object .op values",
+          "severity": "CRITICAL",
+          "description": "### Summary\n\n`shell-quote`'s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (`\\n`, `\\r`, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal `\\n` as a command separator, so any content after it would execute as a second command.\n\nThe vulnerable code path is reachable in two ways. Neither requires the parser to misbehave — `parse()` only emits ops from a fixed control set — but both are documented API surface:\n\n1. **Direct construction.** A caller builds `{ op: '...\\n...' }` from external input (e.g. a deserialized argument array) and passes it to `quote()`.\n2. **`envFn` return.** `parse(cmd, envFn)` is documented to splice the return value of `envFn` into the result array when it is an object. An attacker-influenced data source consulted by `envFn` can introduce an object token whose `.op` reaches `quote()`.\n\n### Impact\n\nShell command injection in callers that pass object tokens with attacker-influenced `.op` values to `quote()` and then hand the result to a shell. The preconditions are narrower than ordinary string injection — they require the caller to feed object tokens into `quote()` — but object tokens are a public, documented part of the API surface, and `quote()` is intended to be a shell-safety boundary.\n\n### PoC\n\n```js\nconst { parse, quote } = require('shell-quote');\n\n// Direct construction\nquote([{ op: ';\\nid' }]);\n// → \"\\;\\n\\\\i\\\\d\"  ← literal newline; second line executes as a command\n\n// Via parse() with an envFn returning attacker-shaped objects\nconst tokens = parse('echo $X', () => ({ op: ';\\nid' }));\nrequire('child_process').execSync(quote(tokens), { shell: true });\n// Executes `id` after `echo \\;`.\n```\n\nConfirmed under `sh`, `bash`, `dash`, and `zsh`.\n\n### Patch\n\nFixed by replacing the per-character escape with strict shape validation in `quote()`. The object-token branch now:\n\n- **`{ op }`** — `.op` must be a string from the same allowlist the parser emits (`||`, `&&`, `;;`, `|&`, `<(`, `<<<`, `>>`, `>&`, `<&`, `&`, `;`, `(`, `)`, `|`, `<`, `>`). Anything else throws `TypeError`. This is the direct fix for the reported issue and removes the entire class of `.op` injection.\n- **`{ op: 'glob', pattern }`** — `.pattern` must be a string with no line terminators. Glob metacharacters (`*`, `?`, `[`, `]`, `{`, `}`, `,`) pass through; all other shell-special characters are backslash-escaped. (Previously the pattern field was discarded entirely and the literal string `\\g\\l\\o\\b` was emitted — a latent bug, not security-relevant.)\n- **`{ comment }`** — `.comment` must be a string with no line terminators (line terminators would end the shell comment and resume command parsing — same injection shape).\n- **Any other object shape** — `TypeError`.\n\nThe fix is allowlist-based rather than a targeted regex tweak, so it closes the reported vector and forecloses adjacent ones (U+2028 / U+2029 line separators in `.op`, line terminators in comments, unknown-shape objects coerced through `.replace`).\n\n### Workarounds\n\nPrior to upgrading, callers that build object tokens from untrusted input should validate `.op` against the parser's operator set themselves, and never construct `{ op }` from attacker-controlled strings.\n\n### Credits\n\nReported by Akshat Sinha"
+        }
+      },
+      "description": "",
+      "license": "",
+      "tier": "free"
+    }
+  }
+}