An open index of dependabot pull requests across open source projects.

shell-quote

Ecosystem:
npm
Package URL:
pkg:npm/shell-quote
Total PRs:
58,692 Dependabot PRs
Latest PR:
about 6 hours ago
Unique Repositories:
58,376 repositories
Unique Repos (30 days):
130 repositories
Security Advisories
Potential Command Injection in shell-quote
GHSA-qg8p-v9q4-gh34 CVE-2016-10541 CRITICAL published over 7 years ago • updated 2 days ago
Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to e...
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
GHSA-pqg4-j6r4-53mv CVE-2026-102422 CRITICAL published 24 days ago • updated 3 days ago
### Impact `quote()` emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening...
Improper Neutralization of Special Elements used in a Command in Shell-quote
GHSA-g4rg-993r-mgx7 CVE-2021-42740 CRITICAL published over 4 years ago • updated 18 days ago
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex de...
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
GHSA-395f-4hp3-45gv CVE-2026-13311 HIGH published 3 months ago • updated 4 days ago
### Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the accumulator. Each `prev.co...
shell-quote quote() does not escape newlines in object .op values
GHSA-w7jw-789q-3m8p CVE-2026-9277 CRITICAL published 5 months ago • updated 4 days ago
### Summary `shell-quote`'s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field ...
Recent PRs
Package Details
Name: shell-quote
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/shell-quote
JSON API: View JSON
Security Advisories

5

Active advisories
CRITICAL 4
HIGH 1
View All npm Advisories
Package Information
Description:

quote and parse shell commands

Repository: https://github.com/ljharb/shell-quote
Homepage: https://github.com/ljharb/shell-quote
Latest Release: 1.8.3
over 1 year ago
Dependent Repos: 2,355,456
Dependent Packages: 1,586
Downloads: 110,381,215
Ranking: Top 0.0112% by dependent repos Top 0.0225% by downloads Top 0.0475% by dependent pkgs
PR Status
Open 57,426 (97.8%)
Merged 198 (0.3%)
Closed 1,010 (1.7%)
PR Types
Major 3 (0.0%)
Minor 57,761 (98.4%)
Patch 740 (1.3%)
Removal 68 (0.1%)