Shell-quote_project Shell-quote
3 CVEs affecting Shell-quote_project Shell-quote. Latest disclosed: 2026-06-25. Critical: 2, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42740 | Critical | 9.8 | 2021-10-21 | The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to su… |
CVE-2016-10541 | Critical | 9.8 | 2018-05-31 | The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-qu… |
CVE-2026-13311 | High | 7.5 | 2026-06-25 | shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire gro… |