ljharb/shell-quote Security Advisories | GitStock

critical2026-10-06

shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

GHSA-pqg4-j6r4-53mv · CVE-2026-102422

high2026-07-20

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

GHSA-395f-4hp3-45gv · CVE-2026-13311

critical2026-06-09

shell-quote quote() does not escape newlines in object .op values

GHSA-w7jw-789q-3m8p · CVE-2026-9277

critical2022-05-24

Improper Neutralization of Special Elements used in a Command in Shell-quote

GHSA-g4rg-993r-mgx7 · CVE-2021-42740