dylanzahedi/cve-2026-9277Proof-of-concept exploit for CVE-2026-9277, a command injection vulnerability in shell-quote library. Performs recursive JSON traversal with combinatorial mutation to trigger RCE, supporting OOB verification and zero-noise logging.
A specialized Proof of Concept (PoC) exploit script designed to verify and demonstrate CVE-2026-9277—a structural Command Injection vulnerability found in legacy versions of the shell-quote library (<= 1.8.3).
The scanner performs deep structural manipulation on input JSON payloads to expose remote code execution (RCE) vectors via recursive traversal, preventing false positives using a dynamic network baseline timing engine.
{"op": "..."} components from arguments to successfully bypass string isolation controls.Ensure you have Python 3.10+ and the required packages installed:
git clone https://github.com/DylanZahedi/CVE-2026-9277.git
cd CVE-2026-9277
pip install requests urllib3
python CVE-2026-9277.py -u "https://example.com/command" -b '{"message_tokens": ["Hello", "from", "normal user"]}'
python CVE-2026-9277.py -u "https://example.com/command" -b '{"user": {"commands": ["a", "b"]}}' -w "https://webhook.site/your-uuid-here"
