Shell-quote vulnerabilities
We track 2 vulnerabilities in Shell-quote products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest Shell-quote vulnerabilities
- 8.1 High severity
shell-quote: Improper Neutralization of Special Elements used in an OS Command
shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string ther
- 8.1 High severity
shell-quote: Improper Neutralization of Special Elements used in a Command
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028