shell-quote vulnerabilities
CVEs whose affected-version data names the shell-quote package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-13311High· 7.5shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
▾ Twilightshell-quote · shell-quoteEPSS 0.36%via GHSA
CVE-2026-9277High· 8.1PoCshell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line term…
▾ MidnightEPSS 0.85%via NVD