npm

shell-quote

Security advisories for shell-quote, newest first. 1 known, all fixed. If you’re on 1.11.0 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

1.12.0

Advisories

1 · 0 unfixed

Last advisory

6 Oct 2026

Safe from

1.11.0

1 advisory · newest first

CRITICAL8.1 6 Oct 2026

shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

GHSA-pqg4-j6r4-53mv · CVE-2026-102422

Affected

≥ 1.8.4, < 1.11.0

Fixed in

1.11.0

Published

6 Oct 2026

/advisories/npm/shell-quote/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →