Security
A Newline in shell-quote Just Punched a Hole in Your Agent's Sandbox
CVE-2026-9277 lets a single newline character turn one shell command into two inside your agent's sandbox. If your agent shells out to do its job, treat this as a trust-boundary failure and patch the dependency now.
Jun 10, 2026Verified