StackRadar

CVE-2026-9277

High

Advisory

Published 9 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.008
56th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
84
of 17,781 indexed, latest versions
Container images
81
deployed by those charts
Fix available
1 of 1
affected package

shell-quote quote() does not escape newlines in object .op values

Carried by container images the latest versions of 84 of 17,781 indexed charts deploy, on 81 images.

Affected packageAffected versionsFixed inImages
shell-quotenpm1.4.3, 1.6.1, 1.7.2, 1.7.3+5 more1.8.481
OSV records
GHSA-w7jw-789q-3m8p

Charts affected

84 by stars
ChartLatestAffected imagesRadar Score
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
shell-quote@1.8.1
1.8.4

Open the chart page →

7,210
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
shell-quote@1.8.1
1.8.4

Open the chart page →

5,352
umamichristianhuthVerified publisher7.13.01 of 2See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
shell-quote@1.8.3
1.8.4

Open the chart page →

2,367
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
shell-quote@1.6.1
1.8.4

Open the chart page →

10,732
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
shell-quote@1.7.4
1.8.4

Open the chart page →

1,255
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
shell-quote@1.7.2
1.8.4

Open the chart page →

5,251
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
shell-quote@1.8.1
1.8.4

Open the chart page →

3,795
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
shell-quote@1.8.1
1.8.4

Open the chart page →

17,404
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
shell-quote@1.7.3
1.8.4

Open the chart page →

7,579
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
shell-quote@1.7.2
1.8.4

Open the chart page →

3,476
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
shell-quote@1.6.1
1.8.4

Open the chart page →

5,209
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
thmmniii/fbs-qcm-frontend:v1.27.1a347f7f4d144
shell-quote@1.8.1
1.8.4

Open the chart page →

28,534
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
shell-quote@1.8.3
1.8.4

Open the chart page →

4,016
data-fairdata354-helmVerified publisher1.1.25 of 12See more

data-fair data354-helm 1.1.2

5 of the 12 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
shell-quote@1.8.1
1.8.4
ghcr.io/data-fair/metrics:0a8d40779eeae
shell-quote@1.7.3
1.8.4
ghcr.io/data-fair/notify:3c739b74dabb0
shell-quote@1.8.2
1.8.4
ghcr.io/data-fair/processings:15a9216989707
shell-quote@1.8.1
1.8.4
ghcr.io/data-fair/simple-directory:438a4f32fad82
shell-quote@1.7.3
1.8.4

Open the chart page →

38,346
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
shell-quote@1.7.4
1.8.4

Open the chart page →

3,925
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
shell-quote@1.8.3
1.8.4

Open the chart page →

31,510
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
shell-quote@1.7.2
1.8.4

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
shell-quote@1.7.3
1.8.4

Open the chart page →

7,801
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
shell-quote@1.8.2
1.8.4

Open the chart page →

5,228
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
shell-quote@1.7.3
1.8.4

Open the chart page →

3,143
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
shell-quote@1.8.3
1.8.4

Open the chart page →

2,575
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
shell-quote@1.8.2
1.8.4

Open the chart page →

2,823
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
shell-quote@1.8.3
1.8.4

Open the chart page →

5,213
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
shell-quote@1.7.2
1.8.4

Open the chart page →

7,517
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
shell-quote@1.8.1
1.8.4

Open the chart page →

12,581
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
shell-quote@1.7.3
1.8.4

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
shell-quote@1.7.3
1.8.4

Open the chart page →

2,396
openapiassist-iot-open-api-management0.2.22 of 6See more

openapi assist-iot-open-api-management 0.2.2

2 of the 6 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
shell-quote@1.8.0
1.8.4
pantsel/konga:latestc8172b75607d
shell-quote@1.6.1
1.8.4

Open the chart page →

18,277
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
shell-quote@1.8.1
1.8.4

Open the chart page →

32,501
registry-uibryanalves0.2.01 of 1See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
konradkleine/docker-registry-frontend:v2181aad54ee64
shell-quote@1.4.3
1.8.4

Open the chart page →

4,069
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
shell-quote@1.6.1
1.8.4

Open the chart page →

25,456
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
shell-quote@1.8.1
1.8.4

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
shell-quote@1.8.1
1.8.4

Open the chart page →

5,141
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
shell-quote@1.8.1
1.8.4

Open the chart page →

5,141
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
shell-quote@1.7.2
1.8.4

Open the chart page →

12,907
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
shell-quote@1.7.4
1.8.4

Open the chart page →

9,146
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
shell-quote@1.6.1
1.8.4

Open the chart page →

5,209
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
cspconsole/report-processor:1.0.279a2d8840bfdf
shell-quote@1.8.1
1.8.4

Open the chart page →

12,274
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
shell-quote@1.7.2
1.8.4

Open the chart page →

3,744
croniclehelmforgeVerified publisher1.1.101 of 1See more

cronicle helmforge 1.1.10

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
soulteary/cronicle:0.9.80ac2512fa6e39
shell-quote@1.7.3
1.8.4

Open the chart page →

1,271
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
shell-quote@1.8.3
1.8.4

Open the chart page →

2,538
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
shell-quote@1.8.1
1.8.4

Open the chart page →

3,407
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
shell-quote@1.6.1
1.8.4

Open the chart page →

32,915
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
shell-quote@1.8.1
1.8.4

Open the chart page →

11,812
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
shell-quote@1.8.2
1.8.4

Open the chart page →

5,228
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
shell-quote@1.8.3
1.8.4

Open the chart page →

2,548
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
shell-quote@1.8.3
1.8.4

Open the chart page →

2,596
kyso-frontkyso1.0.01 of 1See more

kyso-front kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
kyso/kyso-front:lateste52595c5c16f
shell-quote@1.8.1
1.8.4

Open the chart page →

2,685
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
shell-quote@1.8.3
1.8.4

Open the chart page →

3,555
squareonelsst-sqre0.4.11 of 1See more

squareone lsst-sqre 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-9277.

Container imageDigestPackageFixed in
lsstsqre/squareone:0.4.09ded78e7fe03
shell-quote@1.7.2
1.8.4

Open the chart page →

2,247

Container images carrying it

81 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
thmmniii/fbs-qcm-frontend:v1.27.1a347f7f4d144
shell-quote@1.8.1
1.8.4
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
shell-quote@1.8.1
1.8.4
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
shell-quote@1.7.3
1.8.4
1
vlebediantsev/notes-admin-front:latest007c6670ff48
shell-quote@1.8.1
1.8.4
1
vlebediantsev/notes-project-front:latest945675fd2636
shell-quote@1.8.1
1.8.4
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
shell-quote@1.8.0
1.8.4
1
winfred008/amazon:910a68de5b398
shell-quote@1.8.1
1.8.4
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
shell-quote@1.7.2
1.8.4
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
shell-quote@1.8.3
1.8.4
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
shell-quote@1.8.1
1.8.4
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
shell-quote@1.8.1
1.8.4
1
ghcr.io/data-fair/metrics:0a8d40779eeae
shell-quote@1.7.3
1.8.4
1
ghcr.io/data-fair/notify:3c739b74dabb0
shell-quote@1.8.2
1.8.4
1
ghcr.io/data-fair/processings:15a9216989707
shell-quote@1.8.1
1.8.4
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
shell-quote@1.7.3
1.8.4
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
shell-quote@1.8.2
1.8.4
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
shell-quote@1.8.1
1.8.4
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
shell-quote@1.8.3
1.8.4
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
shell-quote@1.8.3
1.8.4
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
shell-quote@1.8.3
1.8.4
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
shell-quote@1.8.2
1.8.4
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
shell-quote@1.7.2
1.8.4
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
shell-quote@1.8.1
1.8.4
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
shell-quote@1.8.3
1.8.4
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
shell-quote@1.8.3
1.8.4
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
shell-quote@1.7.4
1.8.4
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
shell-quote@1.8.3
1.8.4
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
shell-quote@1.8.3
1.8.4
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
shell-quote@1.6.1
1.8.4
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
shell-quote@1.7.2
1.8.4
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
shell-quote@1.8.3
1.8.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.