shell-quote

1.12.0 · 2 Oct 2026MIT96.3M / weekRepository npm Atom feed

Your version

1.2.0

13 May 2013Where it was published

1.12.0 is the newest release of 1.x.

In short

1 new1 fixed1 internal

Security

3 advisories affect 1.2.0; 1.9.0 fixes them

Critical
shell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p · 9 Jun 2026
Fixed in 1.8.4
Critical
Potential Command Injection in shell-quoteGHSA-qg8p-v9q4-gh34 · 18 Feb 2019
Fixed in 1.6.1
High
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026
Fixed in 1.9.0

Release note

Commits

Add the special vars to the replace regex but the chunker breaks on them d1ff82a
Fixed the env test, everything is fine a45897f