AIKIDO-2026-972994

TL;DR

quote() emits a { comment } token as # followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator inside a later token ends that comment early, so the remainder of the token is parsed and executed as shell input when the output is passed to sh, bash, dash, ksh, or zsh. parse() can also emit a mid-word comment token, for example from a URL fragment like http://example.com/#frag, so callers that combine parse() output with another untrusted string reach the same sink through quote(parse(untrustedCommand).concat(untrustedArg)). The fix makes quote() throw a TypeError when any string token after a { comment } token contains a line terminator.