VDB
RHSA-2026:62410
RHSA-2026:62410
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ovirt-csi-driver-rhel8@sha256:0029da1ca5de2180e620faea4b2212f7f6214df88d01d56dde68a7728c2db91c_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ca7bef7243ca819294c2b8882b65eb12da6316d267bd9cb2ad13b401ea12d90c_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ironic-static-ip-manager-rhel9@sha256:5d1538d7a5d75b1e46c8c5fae46d0112a314953bdfba914d2ee1cbd2f9a7c9ec_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-operator-controller-rhel8@sha256:299006a6e1b8c12072c445f9f6a773b42327901e44721c668974ef9fb0616fc3_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-server-rhel8@sha256:b73749a8196758889f1a703303287e95bdeb8ce69c1db48aad44e88e66d2b3f0_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-node-driver-registrar@sha256:7e490a33fe90a3614a217a97400e1536d8c549c7c59136fd64ea0c3e55bf17b0_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe@sha256:2e89a758bb3004fde3e18c6788e1f933f90a0aaf215f1b838e0604c8ead06b82_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-operator@sha256:02309ad92d43ccfd18f94685446a94ddd527597f9b2e3cb70ae037ef33585781_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshotter@sha256:9ff6159be82f530f6ca0d3ebb894babed0b47d3000d7bdd33517e8b94b7383a3_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-etcd-rhel8-operator@sha256:839209c6c1f42e41ef11201f004909cdb5e65670cb094d38bea068f6f4a21187_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-artifacts@sha256:a0be2a79511cbc044a378f4dbdca5b0fa1e2015a9a61133cd278ea35db662fc3_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-must-gather@sha256:94b3e89c766a66219ff1df199657f86897e776cad1965e612b217771960ecf3a_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-openstack-rhel8@sha256:92943fd75f12f076a0c1798c59c35a16db52e50c331d2baa215450479c9f653f_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-configmap-reloader@sha256:5b528c9cd0b39d3166e4694e4ae2dbf3999b4107516f19529077176f8e0af060_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel8@sha256:d14a06b1b8a7132d85bc02390e6ea8674b9e51a66c155dfbc1193eb3c2759f88_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-machine-controllers@sha256:ecd3e703f0a579c50d0d89e521602aa1c9860a3c993279c8e6fb2c28ab2af742_s390x as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-state-metrics@sha256:1b1c2066bf8918ae2f87baeabee58189e58e106cb63a3023336edb703643ad86_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel8@sha256:8085151718eff5c6c150f94fd01864c70eb892eeec44b0c491f2ca58abbde0dc_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-cluster-api-controllers-rhel8@sha256:d5e2839451c62b980ddf953760ed52d5adba85926bbd5f6017d451fbeb7f69c7_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-resizer-rhel8@sha256:122f5e8631ed561c5dc032d3e70b120c1a06839cc1840dcc55132a4b64e0791e_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | * |
…and 655 more
Timeline
- Sep 11, 2026 CVE Published
- Sep 27, 2026 CVE Updated
- Sep 27, 2026 Distribution Patch
- Sep 27, 2026 Distribution Patch
- Sep 27, 2026 Security Advisory
- Sep 27, 2026 Security Advisory
- Sep 27, 2026 Security Advisory
- Sep 27, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:62410 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-54423 advisory
- https://access.redhat.com/security/cve/CVE-2026-9277 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62410.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480741 issue
- https://www.cve.org/CVERecord?id=CVE-2026-9277 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9277 advisory
- https://github.com/ljharb/shell-quote advisory
- https://github.com/ljharb/shell-quote/commit/1518179 advisory
- https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p advisory
- https://www.npmjs.com/package/shell-quote advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
…and 5 more