CLEANSTART-2026-OV74221: shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates network access is required, while no privileges or user interaction are required. Exploitation is rated as high complexity.

Q: What could successful exploitation affect?

The reported impact includes high confidentiality, integrity, and availability impact. The scope is listed as unchanged.

Q: Which product is identified as affected?

The affected software is identified as cleanstart/argo-workflows. No affected or fixed version information is provided.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. shell-quote's quote() function did not validate object-token inputs against the operator model used by parse().

Affected Software

2 affected componentsFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2

Event History

Nov 11, 2026

Advisory Published

via OSV·12:41 AM

Data Sourced

via OSV·12:41 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-9277

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates network access is required, while no privileges or user interaction are required. Exploitation is rated as high complexity.

What could successful exploitation affect?

The reported impact includes high confidentiality, integrity, and availability impact. The scope is listed as unchanged.

Which product is identified as affected?

The affected software is identified as cleanstart/argo-workflows. No affected or fixed version information is provided.

CLEANSTART-2026-OV74221: shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What could successful exploitation affect?

Which product is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What could successful exploitation affect?

Which product is identified as affected?