shell-quote

1.12.0 · 2 Oct 2026MIT96.3M / weekRepository npm Atom feed

Your version

1.7.1

13 Aug 2019Where it was published

1.12.0 is the newest release of 1.x.

In short

1 fixed

Security

3 advisories affect 1.7.1; 1.9.0 fixes them

Critical
shell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p · 9 Jun 2026
Fixed in 1.8.4
Critical
Improper Neutralization of Special Elements used in a Command in Shell-quoteGHSA-g4rg-993r-mgx7 · 24 May 2022
Fixed in 1.7.3
High
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026
Fixed in 1.9.0

Release note

Fix $ being removed when not part of an environment variable name. (@Adman in #32)