---
title: "shell-quote security advisories"
description: "5 known security advisories for shell-quote, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/shell-quote/security
lang: en
---

[Packages](https://inlinr.com/packages)

# shell-quote

1.12.0 · 2 Oct 2026 MIT 96.3M / week [Repository](https://github.com/ljharb/shell-quote) [npm](https://www.npmjs.com/package/shell-quote) [Atom feed](https://inlinr.com/packages/feed/shell-quote)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                               |
| ---- | ------ | ----------------------------------------------------------------------------- |
|      | 1.12.0 | Safe from 1.11.0                                                              |
|      | 0.1.1  | 4 open advisories, worst critical  · last release Apr 2013, no longer updated |

- Critical  
[shell-quote: \`quote()\` command injection via a line terminator in a token after a \`{ comment }\` token](https://inlinr.com/advisories/GHSA-pqg4-j6r4-53mv)GHSA-pqg4-j6r4-53mv · 6 Oct 2026  
fixed in 1.11.0
- Critical  
[shell-quote quote() does not escape newlines in object .op values](https://inlinr.com/advisories/GHSA-w7jw-789q-3m8p)GHSA-w7jw-789q-3m8p · 9 Jun 2026  
fixed in 1.8.4
- Critical  
[Improper Neutralization of Special Elements used in a Command in Shell-quote](https://inlinr.com/advisories/GHSA-g4rg-993r-mgx7)GHSA-g4rg-993r-mgx7 · 24 May 2022  
fixed in 1.7.3
- Critical  
[Potential Command Injection in shell-quote](https://inlinr.com/advisories/GHSA-qg8p-v9q4-gh34)GHSA-qg8p-v9q4-gh34 · 18 Feb 2019  
fixed in 1.6.1
- High  
[shell-quote: Quadratic-complexity Denial of Service in \`parse()\` (CWE-407)](https://inlinr.com/advisories/GHSA-395f-4hp3-45gv)GHSA-395f-4hp3-45gv · 20 Jul 2026  
fixed in 1.9.0

### Quality and security signals

What [npm](https://www.npmjs.com/package/shell-quote) and [deps.dev](https://deps.dev/npm/shell-quote) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Reading releases, release notes and advisories…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.