CVE-2026-102422 - shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
CVE ID :CVE-2026-102422 Published : Sept. 29, 2026, 3:47 a.m. | 28 minutes ago Description :shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line...