Vendors / Shell-quote Project Records 3 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 1
Exploited now Shell-quote Project records in CISA KEV No Shell-quote Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 77
shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.0036 · Published 2026-06-25 · Partial fix · 1.9.0 CWE-407
Priority MEDIUM 49
The shell-quote package before 1.7.3 for Node.js allows command injection.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04221 · Published 2021-10-21 · Fixed in 1.7.3 CWE-77
Priority MEDIUM 46
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02216 · Published 2018-05-31 · Fixed in 1.6.1 CWE-78
Open these records in search → All records by CVSS severity
2 1 0 0 0
