REPRO-2026-00224: Node.js task runner improperly escapes single quotes on Unix, enabling shell syntax breakouts and potential command injection via `node --run` arguments.
REPRO-2026-00224 is verified against node · nodejs affected versions: v22.23.0, v24.17.0, v26.3.1 confirmed vulnerable on Linux x64. --run was added in v22.0.0, older versions without --run are not affected. Windows not tested. fixed version: Commit e76c573e4546ce9e89e0dd954f80aaba32148a48 vulnerability class: Command Injection This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00224.
pruva-verify REPRO-2026-00224 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00224/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Node.js task runner EscapeShell routine incorrectly escapes single quotes on POSIX shells. It replaces ' with ' inside single-quoted strings, but in POSIX shell syntax a backslash does not escape a single quote within single quotes. This allows crafted arguments passed to node --run <script> -- <args> to break out of the single-quoted context, causing shell syntax errors or command injection.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.