npmPackage

shell-quote

5 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release: 1.12.0 (Oct 2, 2026): no advisory affects it
Newest unaffected release: 1.12.0 (Oct 2, 2026), the latest release
Advisories: 5 · 3 high

Weekly downloads: 96.6M
Dependents: 75.5K
Releases: 34 since 0.0.0 (May 18, 2012)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-102422
Affects 1.8.4 to 1.10.0 (1.11.0 is outside it)
CVE-2026-13311
Affects 0.0.0 to 1.8.4 (1.9.0 is outside it)
CVE-2026-9277
Affects 1.1.0 to 1.8.3 (1.8.4 is outside it)
CVE-2021-42740
Affects 1.6.3 to 1.7.2 (1.7.3 is outside it)
CVE-2016-10541
Affects 0.0.0 to 1.6.0 (1.6.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

CVE-2026-102422High 8.1
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
Affected: from 1.8.4, fixed in 1.11.0.
Fixed in 1.11.0 (released Sep 29, 2026, the day of disclosure).
The latest release, 1.12.0, is not affected.
27% of shell-quote downloads last week were affected versions (29.2M).
CVE-2026-13311High 8.7
shell-quote parse() is quadratic in token count, enabling denial of service
Affected: through 1.8.4; fixed in 1.9.0.
Fixed in 1.9.0 (released Jun 25, 2026, the day of disclosure).
The latest release, 1.12.0, is not affected.
46% of shell-quote downloads last week were affected versions (50.2M).
CVE-2026-9277High 8.1
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
Affected: from 1.1.0, fixed in 1.8.4; from 1.1.0, fixed in 1.8.4.
Fixed in 1.8.4 (released May 22, 2026, the day of disclosure).
The latest release, 1.12.0, is not affected.
36% of shell-quote downloads last week were affected versions (39.7M).
CVE-2021-42740Unrated
The shell-quote package before 1.7.3 for Node.js allows command injection.
Affected: from 1.6.3, fixed in 1.7.3.
Fixed in 1.7.3 (released Oct 21, 2021, the day of disclosure).
The latest release, 1.12.0, is not affected.
1.5% of shell-quote downloads last week were affected versions (1.6M).
CVE-2016-10541Unrated
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell.
Affected: fixed in 1.6.1.
Fixed in 1.6.1 (released Jun 17, 2016, 713 days before disclosure).
The latest release, 1.12.0, is not affected.
0.1% of shell-quote downloads last week were affected versions (110.4K).