RHSA-2026:70267 | Vulnetix

RHSA-2026:70267 PUBLISHED CVSS 5.300000190734863 MEDIUM

A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.

Risk Scores

CVSS 3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:7c91331317d27a2647a66f54c439ce276393f8756e6f4044d9d9e562318302af_amd64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:4438575e5faa8c34d4c42327ebec71a590a3ef6aba43fccbb2437d5b176fa64c_arm64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:3a18dd4bf159bb844b805630958b834d561b747e530304bce72c8edff533bb05_amd64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:9b8b79496225ba99f76cedc27aad13b761fa6d081fc229b8caeafffcebc529c6_ppc64le as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:1a1eaf93cb0d184c940fb5faf3d8d4a6348919a7f0318b98d95e04cc84a10bd0_s390x as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:fe7fa40620e9e4a45118b6d97ea7fb94e30b95b90bb110732d5640744c195d0a_ppc64le as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:f668385cf19dd0402bc1bd7bc085e3ddb3ee8a07a3b178bdeccd1331f742406a_amd64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:868d14a60728a32b816af8ac03a95be11e004ec6ccf73afc6c90847eba0600da_arm64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:8c54f9c121acfe6d861f24d7ca3b9f330af63cd6ad9bf5d9ca87e5d414e827ce_amd64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:d11700d820614043a3b36025faad080b3d48146d80f293670927d844ea5ed725_s390x as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:18d8d95e9fd69f705b79759579922ae7bc892b9fc713354ee3413a3272b53d9b_arm64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:7a1ac0915d132e9fcedd015a34579bb62eb09e80113448c21aa65387d1c502aa_arm64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:c53d4d738b80e960b1858ae5d1b6ddf2aea24e9b571092acff475bfbfb5606dc_ppc64le as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:ac5b77ab6ff988eb0a4590aa06f7f5c6ec7b8ca20532a2dc8273cf9c418550f3_s390x as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:d8c30b66bb001b9a4aee84e3f8160aa604db7b078da069b6cc4a2a5fcdb3e7b8_arm64 as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:5b84a0eaf797a5d7cbfa7d99ac3df0e8fe4e7c627a7d462001d56f17f745fd80_s390x as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:88b3a9ac2fc065ecf22284f201a4b3f08a2d0855566d9724ad1db1d782963360_s390x as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:242cebeb09263d507c51315918c1f6af3843d95090d15b5cb6d509d2a4850f50_ppc64le as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2a06097fa7a38f2c06ff9d16e2bb5a691b7d3eb5b3d0474e854239ee85114f3e_ppc64le as a component of Red Hat Quay 3.14	*
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:5ab9413d3b6291049d4d2e6c4f3b1ac0db9587e5ea946e1853f60eabed49d8bd_s390x as a component of Red Hat Quay 3.14	*

…and 11 more

Timeline

Sep 22, 2026 CVE Published
Sep 23, 2026 CVE Updated
Sep 23, 2026 Distribution Patch
Sep 23, 2026 Distribution Patch
Sep 23, 2026 Security Advisory
Sep 23, 2026 Security Advisory
Sep 23, 2026 Security Advisory
Sep 23, 2026 Security Advisory
Sep 23, 2026 Security Advisory
Sep 23, 2026 Security Advisory
Sep 23, 2026 Security Advisory
Sep 23, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:70267 advisory
https://access.redhat.com/security/cve/CVE-2026-10143 advisory
https://access.redhat.com/security/cve/CVE-2026-12143 advisory
https://access.redhat.com/security/cve/CVE-2026-13149 advisory
https://access.redhat.com/security/cve/CVE-2026-13676 advisory
https://access.redhat.com/security/cve/CVE-2026-14257 advisory
https://access.redhat.com/security/cve/CVE-2026-15792 advisory
https://access.redhat.com/security/cve/CVE-2026-15927 advisory
https://access.redhat.com/security/cve/CVE-2026-16221 advisory
https://access.redhat.com/security/cve/CVE-2026-18255 advisory
https://access.redhat.com/security/cve/CVE-2026-32591 advisory
https://access.redhat.com/security/cve/CVE-2026-33747 advisory
https://access.redhat.com/security/cve/CVE-2026-33748 advisory
https://access.redhat.com/security/cve/CVE-2026-33818 advisory
https://access.redhat.com/security/cve/CVE-2026-39820 advisory
https://access.redhat.com/security/cve/CVE-2026-39821 advisory
https://access.redhat.com/security/cve/CVE-2026-39822 advisory
https://access.redhat.com/security/cve/CVE-2026-39828 advisory
https://access.redhat.com/security/cve/CVE-2026-39829 advisory
https://access.redhat.com/security/cve/CVE-2026-39830 advisory

…and 476 more

Open in Interactive Console →