Vulnerabilities

TI-2026-11280 CVE-2026-13311 · GHSA-395f-4hp3-45gv

shell-quote parse() is quadratic in token count, enabling denial of service

HIGH 77

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0036 Published 2026-06-25 Partial fix · 1.9.0 CWE-407

TI-2021-18949 CVE-2021-42740 · GHSA-g4rg-993r-mgx7

The shell-quote package before 1.7.3 for Node.js allows command injection.

MEDIUM 49

The shell-quote package before 1.7.3 for Node.js allows command injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04221 Published 2021-10-21 Fixed in 1.7.3 CWE-77

TI-2016-08583 CVE-2016-10541 · GHSA-qg8p-v9q4-gh34

OS command injection in HackerOne shell-quote node module

MEDIUM 46

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02216 Published 2018-05-31 Fixed in 1.6.1 CWE-78

Vulnerabilities

Filters

shell-quote parse() is quadratic in token count, enabling denial of service

The shell-quote package before 1.7.3 for Node.js allows command injection.

OS command injection in HackerOne shell-quote node module