$ the-wire · showcase
React Native patches critical shell-quote RCE
By RepoJournal · Filed · About Meta
A critical arbitrary code execution vulnerability in shell-quote forces a mandatory React Native upgrade.
Facebook's React Native repo shipped an emergency fix overnight, upgrading shell-quote from 1.8.2 to 1.8.4 to address CVE-2026-9277, a CRITICAL arbitrary code execution vulnerability [1]. The vulnerability, identified by Trivy in the yarn.lock dependency tree, is not confirmed reachable, but the severity demands immediate action. Developer anupamme's patch [#57663] is a straightforward dependency bump, making it a low-risk change you should adopt right away. Meanwhile, Jest's CoverageReporter test migration off mock-fs signals a broader compatibility issue: mock-fs throws on Node 26.8+ due to a change in how fs.readFile works [2]. The jestjs/jest team is proactive in adapting their test suite, which is worth watching if you rely on mock-fs in your CI. On the Android front, React Native's Networking module now synthesizes a default User-Agent of "AppName/Version" when none is supplied, aligning Android behavior with iOS [3]. This change could affect server-side request filtering or analytics, so review your backend assumptions. Also in progress (both are [DEVELOPING], not merged): a fix to prevent data races in Yoga's pixel-grid rounding by skipping non-owned subtrees [4], and a CI tweak excluding device-specific screenshot flows from Maestro Cloud to keep tests reliable [5]. The React Native team is tightening both runtime and CI hardening. Also, support for 'react-private-interface' in build-types is landing to unblock future feature flags work [6], but it's an internal infra change with minor immediate impact.
Action items
- → Upgrade React Native to a version including shell-quote 1.8.4 before your next release facebook/react-native [immediate]
- → Review server-side handling of React Native Android requests for new User-Agent format facebook/react-native [plan]
- → Audit your own usage of mock-fs with Node 26.8+ and plan a migration facebook/jest [plan]
References
- [1] fix: upgrade shell-quote to 1.8.4 (CVE-2026-9277) (#57663) facebook/react-native
- [2] chore: migrate `CoverageReporter` test off `mock-fs` ↗ facebook/jest
- [3] Android: default User-Agent includes app name and version (#58147) facebook/react-native
- [4] Skip non-owned subtrees in roundLayoutResultsToPixelGrid (#58144) facebook/react-native
- [5] Skip device-specific screenshot flows in Maestro Cloud (#58166) facebook/react-native
- [6] Support 'react-native/react-private-interface' in build-types (#58075) facebook/react-native
