shell-quote

1.12.0 · 2 Oct 2026MIT96.3M / weekRepository npm Atom feed

Your version

1.3.0

13 May 2013Where it was published

1.12.0 is the newest release of 1.x.

In short

8 changed

Security

3 advisories affect 1.3.0; 1.9.0 fixes them

Critical
shell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p · 9 Jun 2026
Fixed in 1.8.4
Critical
Potential Command Injection in shell-quoteGHSA-qg8p-v9q4-gh34 · 18 Feb 2019
Fixed in 1.6.1
High
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026
Fixed in 1.9.0

Release note

Commits

Hacky tokenizer is much simpler 7e91b18
Nearly passing with a clunky state env parser, array issues d6d6416
Test for functional env expansion 666395f
Upgrade travis versions, tape f6f8bd6
1.3.0, document env() lookups 041c5da
First half of functional env() works 7a0cf79
env() objects even work inside quote strings 16139f5
Another check just to make sure env() works 914a1a9