shell-quote vulnerabilities
CVEs whose affected-version data names the shell-quote package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-102422High· 8.1PoCshell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token
shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in…
▾ Midnightshell-quote · shell-quoteEPSS 0.38%via NVD
CVE-2026-9277High· 8.1PoCshell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line term…
▾ MidnightEPSS 0.79%via NVD