Repository navigation
Security: ljharb/shell-quote
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
`quote()` command injection via a line terminator in a token after a `{ comment }` tokenGHSA-pqg4-j6r4-53mv published
Sep 29, 2026 by ljharbHigh -
Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv published
Jun 25, 2026 by ljharbHigh -
shell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p published
May 22, 2026 by ljharbHigh