shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 1.12.0 | Safe from 1.11.0 | |
| 0.1.1 | 4 open advisories, worst critical · last release Apr 2013, no longer updated |
- Criticalshell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenGHSA-pqg4-j6r4-53mv · 6 Oct 2026fixed in 1.11.0
- Criticalshell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p · 9 Jun 2026fixed in 1.8.4
- CriticalImproper Neutralization of Special Elements used in a Command in Shell-quoteGHSA-g4rg-993r-mgx7 · 24 May 2022fixed in 1.7.3
- CriticalPotential Command Injection in shell-quoteGHSA-qg8p-v9q4-gh34 · 18 Feb 2019fixed in 1.6.1
- Highshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026fixed in 1.9.0
Reading releases, release notes and advisories…
Registry facts last checked 4 Nov 2026. Releases and advisories last read 4 Nov 2026.