shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 1.7.2 to 1.7.3
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 0
- changes to make
- 1
- advisory fixed
- 0
- new
- 0
- fixes
Security
2 advisories still affect 1.7.3
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)high · GHSA-395f-4hp3-45gv
- shell-quote quote() does not escape newlines in object .op valuescritical · GHSA-w7jw-789q-3m8p
Upgrading to 1.9.0 clears them.
Fixes 1 advisory affecting 1.7.2
- Improper Neutralization of Special Elements used in a Command in Shell-quotecritical · GHSA-g4rg-993r-mgx7
- 1.7.3
Fix a security issue where the regex for windows drive letters allowed some shell meta-characters to escape the quoting rules. (CVE-2021-42740)