{"id":2356117,"name":"shell-quote","ecosystem":"npm","description":"quote and parse shell commands","homepage":"https://github.com/ljharb/shell-quote","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/ljharb/shell-quote","keywords_array":["command","parse","quote","shell"],"namespace":null,"versions_count":34,"first_release_published_at":"2012-05-18T10:42:06.889Z","latest_release_published_at":"2026-10-02T14:58:24.476Z","latest_release_number":"1.12.0","latest_published_release_number":"1.12.0","last_synced_at":"2026-10-27T04:18:53.570Z","created_at":"2022-04-10T00:38:17.345Z","updated_at":"2026-10-27T14:20:42.028Z","registry_url":"https://www.npmjs.com/package/shell-quote","install_command":"npm install shell-quote","documentation_url":null,"metadata":{"funding":{"url":"https://github.com/sponsors/ljharb"},"dist-tags":{"latest":"1.12.0"},"contentPolicy":null},"repo_metadata":{"id":61311616,"uuid":"548978868","full_name":"ljharb/shell-quote","owner":"ljharb","description":null,"archived":false,"fork":false,"pushed_at":"2026-10-02T14:58:33.000Z","size":362,"stargazers_count":66,"open_issues_count":2,"forks_count":27,"subscribers_count":4,"default_branch":"main","last_synced_at":"2026-10-13T04:33:20.037Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ljharb.png","metadata":{"funding":{"github":["ljharb"],"patreon":null,"open_collective":null,"ko_fi":"ljharb","tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"polar":null,"buy_me_a_coffee":null,"thanks_dev":"ljharb","custom":null},"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2022-10-10T13:38:42.000Z","updated_at":"2026-10-11T06:38:11.000Z","dependencies_parsed_at":"2026-10-10T09:32:38.320Z","dependency_job_id":null,"html_url":"https://github.com/ljharb/shell-quote","commit_stats":{"total_commits":188,"total_committers":23,"mean_commits":8.173913043478262,"dds":"0.46808510638297873","last_synced_commit":"9eecafc0486c9321be223415cf3fb76a5bd07dda"},"previous_names":["ljharb/node-shell-quote"],"tags_count":34,"template":false,"template_full_name":null,"purl":"pkg:github/ljharb/shell-quote","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ljharb","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/sbom","scorecard":{"id":594955,"data":{"date":"2025-08-11","repo":{"name":"github.com/ljharb/shell-quote","commit":"487a9b41a7b6154d2a9c10bdffe65cf74d2c3ded"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.9,"checks":[{"name":"Code-Review","score":1,"reason":"Found 4/30 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":3,"reason":"1 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 3","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: security.md:1","Info: Found linked content: security.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: security.md:1","Info: Found text in security policy: security.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-aught.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/node-aught.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-pretest.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/node-pretest.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-tens.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/node-tens.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-twenties.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/node-twenties.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rebase.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rebase.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/require-allow-edits.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/require-allow-edits.yml/main?enable=pin","Info:   0 out of   5 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  11 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/rebase.yml:11","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/rebase.yml:12","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/require-allow-edits.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/node-aught.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/node-pretest.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/node-tens.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/node-twenties.yml:6","Warn: no topLevel permission defined: .github/workflows/nodejs.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/rebase.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/require-allow-edits.yml:6"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 4 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-20T22:55:45.670Z","repository_id":61311616,"created_at":"2025-08-20T22:55:45.671Z","updated_at":"2025-08-20T22:55:45.671Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343843146,"owners_count":38271361,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-13T02:00:04.984Z","response_time":52,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"ljharb","name":"Jordan Harband","uuid":"45469","kind":"user","description":"software engineer/nerd/teacher/will try anything once; surgeon with git rebase. @TC39 ex @Coinbase @Airbnb @Twitter @MobBase. Fav punctuation ⸮, scent petrichor","email":"","website":"https://linkedin.com/in/ljharb","location":"Hillsborough, CA","twitter":"LJHarb","company":"@socketdev @tc39 @ecma-tc54","icon_url":"https://avatars.githubusercontent.com/u/45469?u=6ab74b3b934f9659a90b588062c2c4328e40c6be\u0026v=4","repositories_count":315,"last_synced_at":"2026-10-26T19:07:21.530Z","metadata":{"has_sponsors_listing":true,"funding":{"github":["ljharb"],"patreon":null,"open_collective":null,"ko_fi":"ljharb","tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"polar":null,"buy_me_a_coffee":null,"thanks_dev":"ljharb","custom":null}},"html_url":"https://github.com/ljharb","funding_links":["https://github.com/sponsors/ljharb","https://ko-fi.com/ljharb","https://thanks.dev/ljharb"],"total_stars":11573,"followers":8341,"following":396,"created_at":"2022-11-02T16:19:00.017Z","updated_at":"2026-10-26T19:07:21.540Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ljharb","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ljharb/repositories"},"tags":[{"name":"v1.12.0","sha":"6ecb8aa618ba6dc6c3b087fce6d7660320d2adeb","kind":"tag","published_at":"2026-10-02T14:45:42.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.12.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.12.0/manifests","release_url":null},{"name":"v1.11.0","sha":"88241f8fa324a85da03b40fc69443c069837b472","kind":"tag","published_at":"2026-09-29T02:29:39.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.11.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.11.0/manifests","release_url":null},{"name":"v1.10.0","sha":"64988d9a0e73a2ae710488952e3614958ef289d4","kind":"tag","published_at":"2026-07-10T23:08:44.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.10.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.10.0/manifests","release_url":null},{"name":"v1.9.0","sha":"db09fc7a9e3546807c19e2de2682ec31112a6520","kind":"tag","published_at":"2026-06-25T04:42:22.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.9.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.9.0/manifests","release_url":null},{"name":"v1.8.4","sha":"ff166e2b63eb5f932bd131a8886a99e9afdf45ae","kind":"tag","published_at":"2026-05-22T12:21:53.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.8.4","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.8.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.8.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.4/manifests","release_url":null},{"name":"v1.8.3","sha":"487a9b41a7b6154d2a9c10bdffe65cf74d2c3ded","kind":"tag","published_at":"2025-06-02T05:02:58.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.8.3","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.8.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.8.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.3/manifests","release_url":null},{"name":"v1.8.2","sha":"b19fc77e66871eee10a9978d54c27d802a1da99b","kind":"tag","published_at":"2024-11-27T21:33:27.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.8.2","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.8.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.8.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.2/manifests","release_url":null},{"name":"v1.8.1","sha":"da8a3abb4b2754dd9c1d3203142133e253c515a4","kind":"tag","published_at":"2023-04-07T20:56:06.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.8.1","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.1/manifests","release_url":null},{"name":"v1.8.0","sha":"508e2f9c6439706cc696407d52fec36f78248a19","kind":"tag","published_at":"2023-01-31T03:26:21.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.8.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.8.0/manifests","release_url":null},{"name":"v1.7.4","sha":"5409e72ef6c905c4d1637883cd394f6f07abd934","kind":"tag","published_at":"2022-10-12T22:01:02.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.7.4","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.7.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.7.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.4/manifests","release_url":null},{"name":"v1.7.3","sha":"6a8a899c62a58a30fb128a7079f02826ed4faee0","kind":"tag","published_at":"2021-10-21T06:34:28.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.7.3","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.7.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.7.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.3/manifests","release_url":null},{"name":"v1.7.2","sha":"89a1993809eb7620ec985c3b6869c9079287c35a","kind":"commit","published_at":"2019-08-30T18:37:20.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.7.2","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.2/manifests","release_url":null},{"name":"v1.7.1","sha":"c2950fba942da2d2e17a8fb5a4eaf8f8c72d1ab3","kind":"commit","published_at":"2019-08-13T13:34:41.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.7.1","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.1/manifests","release_url":null},{"name":"v1.7.0","sha":"09ed4dfb9fe315b4a416e36e0c39bda87975494e","kind":"commit","published_at":"2019-08-13T07:51:55.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.7.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.7.0/manifests","release_url":null},{"name":"v1.6.3","sha":"c90d2c69b74865f7018a18e8c847d1fac4efcd28","kind":"commit","published_at":"2019-08-13T07:41:26.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.6.3","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.3/manifests","release_url":null},{"name":"v1.6.2","sha":"fd9e3da9fd9b275dca0eefdb8062306e76528a97","kind":"commit","published_at":"2019-08-13T07:14:54.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.6.2","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.2/manifests","release_url":null},{"name":"v1.6.1","sha":"09935581cd2b300d74a65bda3b1cbeb52779dd16","kind":"tag","published_at":"2016-06-17T20:43:01.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.6.1","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.1/manifests","release_url":null},{"name":"v1.6.0","sha":"88a5280d9c3f5d43fffa538ae9919d1ae579b56e","kind":"tag","published_at":"2016-04-24T05:59:38.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.6.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.6.0/manifests","release_url":null},{"name":"v1.5.0","sha":"609735869389bd3fbc4bac9830f34fcea5cb6e46","kind":"tag","published_at":"2016-03-16T18:03:59.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.5.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.5.0/manifests","release_url":null},{"name":"v1.4.3","sha":"88c9b82e446c32bf782461059d2cb8b147e037d8","kind":"tag","published_at":"2015-03-08T03:49:50.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.4.3","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.3/manifests","release_url":null},{"name":"v1.4.2","sha":"cf747ca3969f4a4a27a7270f1f1cc7665751e8ec","kind":"tag","published_at":"2014-07-20T21:26:41.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.4.2","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.2/manifests","release_url":null},{"name":"v1.4.1","sha":"708e1e31732c46b983611d1174e01f663138ddc1","kind":"tag","published_at":"2013-12-25T00:58:25.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.4.1","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.1/manifests","release_url":null},{"name":"v1.4.0","sha":"9c499321f2d6b817edb7573346b8bb5523069c99","kind":"tag","published_at":"2013-10-18T01:40:17.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.4.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.4.0/manifests","release_url":null},{"name":"v1.3.3","sha":"649fa46319838dccd1bd7511b81fa4bc1c4f4287","kind":"tag","published_at":"2013-06-24T12:01:19.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.3.3","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.3/manifests","release_url":null},{"name":"v1.3.2","sha":"7ab76228cb9b54786b696434c088c3e62a2157fd","kind":"tag","published_at":"2013-06-24T11:49:52.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.3.2","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.2/manifests","release_url":null},{"name":"v1.3.1","sha":"4380811eef06f642a6e5e6764e8938ccf80927d5","kind":"tag","published_at":"2013-05-13T13:47:33.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.3.1","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.1/manifests","release_url":null},{"name":"v1.3.0","sha":"041c5da88800b4e15f0ed023049050b11b623a23","kind":"tag","published_at":"2013-05-13T13:41:19.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.3.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.3.0/manifests","release_url":null},{"name":"v1.2.0","sha":"414eeedd77aa7288d47b597cff3da1c6eb55633a","kind":"tag","published_at":"2013-05-13T12:09:11.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.2.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.2.0/manifests","release_url":null},{"name":"v1.1.0","sha":"9d4a8f57793e3e212b7798d5de4386e073134dfd","kind":"tag","published_at":"2013-05-13T10:34:20.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.1.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.1.0/manifests","release_url":null},{"name":"v1.0.0","sha":"17a40edb3cd7a0f1c44be2be5ddd412c8ca2b7ca","kind":"tag","published_at":"2013-05-13T10:26:12.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v1.0.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v1.0.0/manifests","release_url":null},{"name":"v0.1.1","sha":"ce51b1fb92de142b81c7718e85389389302f326f","kind":"tag","published_at":"2013-04-17T08:04:25.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v0.1.1","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.1.1/manifests","release_url":null},{"name":"v0.1.0","sha":"eef91521b2c7630be38665d192d72b183591a5b3","kind":"tag","published_at":"2013-04-15T04:34:15.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v0.1.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.1.0/manifests","release_url":null},{"name":"v0.0.1","sha":"5ce339feeaf971a5172fe58faa3ac5f90bdfe8b5","kind":"tag","published_at":"2012-05-18T18:25:19.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v0.0.1","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v0.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v0.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.0.1/manifests","release_url":null},{"name":"v0.0.0","sha":"1c72261f45002744fac3fecec3f0395924d66717","kind":"tag","published_at":"2012-05-18T10:41:15.000Z","download_url":"https://codeload.github.com/ljharb/shell-quote/tar.gz/v0.0.0","html_url":"https://github.com/ljharb/shell-quote/releases/tag/v0.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/ljharb/shell-quote@v0.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/tags/v0.0.0/manifests","release_url":null}]},"repo_metadata_updated_at":"2026-10-27T04:18:53.854Z","dependent_packages_count":1586,"downloads":243389899,"downloads_period":"last-month","dependent_repos_count":2355456,"rankings":{"downloads":0.02245145830435635,"dependent_repos_count":0.011170969497777305,"dependent_packages_count":0.04747662036555355,"stargazers_count":8.04753577380752,"forks_count":6.934983570730189,"docker_downloads_count":0.026339393766818056,"average":2.5149929644120355},"purl":"pkg:npm/shell-quote","advisories":[{"uuid":"GSA_kwCzR0hTQS1wcWc0LWo2cjQtNTNtds4AB7yB","url":"https://github.com/advisories/GHSA-pqg4-j6r4-53mv","title":"shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token","description":"### Impact\n\n`quote()` emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input:\n\n```js\nquote(['echo', 'ok', { comment: 'x' }, 'a\\nid;#']);\n// echo ok #x 'a\n// id;#'\n```\n\nPassed to `sh`, `bash`, `dash`, `ksh`, or `zsh`, this runs `id`.\n\n`parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it.\n\nExploitation requires an attacker-controlled string containing a line terminator that follows a `{ comment }` token in the same `quote()` call.\n\n### Patches\n\nFixed in v1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator (`\\n`, `\\r`, U+2028, or U+2029).\n\n### Workarounds\n\nDrop every token after a `{ comment }` token before calling `quote()`, or reject line terminators in untrusted strings. Separately, do not append other shell text after `quote()` output that contains a comment, since the comment swallows it.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-10-06T13:40:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","https://nvd.nist.gov/vuln/detail/CVE-2026-102422","https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","https://github.com/advisories/GHSA-pqg4-j6r4-53mv"],"source_kind":"github","identifiers":["GHSA-pqg4-j6r4-53mv","CVE-2026-102422"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-06T14:04:44.812Z","updated_at":"2026-10-27T14:00:45.825Z","epss_percentage":0.00378,"epss_percentile":0.31501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcWc0LWo2cjQtNTNtds4AB7yB","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wcWc0LWo2cjQtNTNtds4AB7yB","packages":[{"ecosystem":"npm","package_name":"shell-quote","versions":[{"first_patched_version":"1.11.0","vulnerable_version_range":"\u003e= 1.8.4, \u003c 1.11.0"}],"purl":"pkg:npm/shell-quote"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcWc0LWo2cjQtNTNtds4AB7yB/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zOTVmLTRocDMtNDVnds4ABcQ0","url":"https://github.com/advisories/GHSA-395f-4hp3-45gv","title":"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)","description":"### Summary\n`shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses\n`Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing\narray, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who\ncan submit a string to any code path that calls `parse()` on it can block the single-threaded\nNode.js event loop for tens of seconds with a small input — a denial of service. The trigger\nneeds **no shell metacharacters** (plain space-separated words suffice), so input filters that\nonly screen for `;`, `|`, `$`, or backticks do not help.\n\n### Root cause\n`parse.js` (lines 200–203), in `parseInternal` — this path runs on **every** `parse()` call:\n\n```js\n}).reduce(function (prev, arg) { // finalize parsed arguments\n    // TODO: replace this whole reduce with a concat\n    return typeof arg === 'undefined' ? prev : prev.concat(arg);\n}, []);\n```\n\n`prev.concat(arg)` allocates a new array and copies all of `prev` on every iteration, so\nproducing an N-token result costs `1 + 2 + … + N = O(N²)` copies. A second `acc.concat(s)`\nreduce in the `module.exports` wrapper (lines 211–224, reached only when `env` is a function)\nhas the same shape. The maintainer's own `// TODO: replace this whole reduce with a concat`\nalready flags the construct.\n\n### Proof of Concept\n```js\nconst { parse } = require('shell-quote');\nconst ms = fn =\u003e { const t = process.hrtime.bigint(); fn(); return Number(process.hrtime.bigint()-t)/1e6; };\nfor (const N of [16000, 32000, 64000, 128000]) {\n  console.log(N, 'tokens -\u003e', ms(() =\u003e parse('x '.repeat(N))).toFixed(0), 'ms');\n}\n```\n\nMeasured on `shell-quote@1.8.4`, Node v24:\n\n| input (N tokens) | bytes  | `parse()` | ratio vs prev (2× input) |\n|-----------------:|-------:|----------:|:------------------------:|\n| 16 000           | 32 KB  |    678 ms | —                        |\n| 32 000           | 64 KB  |  4 169 ms | ×6.2                     |\n| 64 000           | 128 KB | 14 914 ms | ×3.6                     |\n| 128 000          | 256 KB | **57 319 ms** | ×3.8                 |\n\nTime grows ~×4 per 2× input → confirmed O(n²). A ~128 KB input blocks the event loop ~15 s;\n~256 KB → ~57 s; a few hundred KB more → minutes.\n\u003cimg width=\"656\" height=\"214\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e8955b0e-0527-45ca-94b7-c3a2d8c0c82e\" /\u003e\n[poc.js](https://github.com/user-attachments/files/29255995/poc.js)\n\n### Impact\n`parse()` is synchronous on the main thread; while it copies arrays quadratically the entire\nevent loop is blocked and the process serves no other requests. Any service that calls `parse()`\non attacker-influenced input (command parsers, chat-ops / bot command handlers, REPLs,\nbuild-script / arg-string splitters) can be driven to a sustained DoS with a single small\nrequest. No code execution and no data disclosure — availability only.\n\nEnd-to-end confirmation: a minimal HTTP server that calls `parse()` on the request body, hit\nwith **one** `POST` of `'x '.repeat(32000)` (~63 KB), froze for ~4.5 s. An out-of-process probe\nclient issuing harmless `GET /ping` requests (normally ~1 ms) observed **27 consecutive pings\nstalled by up to 4374 ms** during that single request — i.e. every concurrent client was denied\nservice for the whole parse. Scaling the body to a few hundred KB extends the outage to minutes.\n\nThis is the same class as several accepted 2026 advisories for quadratic-parser DoS on\nuntrusted input (e.g. markdown-it CVE-2026-48988, js-yaml CVE-2026-53550,\npython-multipart CVE-2026-53539). It is **distinct** from the known `shell-quote`\ncommand-injection issues (CVE-2021-42740, CVE-2016-10541, CVE-2026-9277), which are all in\n`quote()`, not `parse()`.\n\n### Suggested remediation\nReplace the O(n²) concat-in-reduce with a linear flatten that **pushes into the\naccumulator** instead of reallocating and copying it on every iteration. Apply the\nsame shape to the wrapper's `acc.concat(s)` reduce. A defensive input-length cap on\n`parse()` is a cheap additional stop-gap.\n\n\u003e **Maintainer note (edit):** the originally-suggested `Array.prototype.flat()` is\n\u003e ES2019 / Node 11+, but `shell-quote` declares `engines: node \u003e= 0.4`, so `.flat()`\n\u003e would silently drop support for older runtimes. The fix instead flattens one-level\n\u003e array tokens with `forEach`/`push` — and deliberately not `push.apply(...)`, since\n\u003e spreading a large array into function arguments can exceed the engine's argument\n\u003e count limit. Output is byte-identical to the current code across strings, `undefined`\n\u003e holes, one-level array tokens, and `{op}`/`{comment}`/`{op:'glob'}` objects, and\n\u003e finalizing is now linear (1,024,000 tokens in ~150 ms vs ~57 s for 128,000 before).\n\u003e Thanks for the clear report and PoC — the analysis and reproduction were spot on.\n\n### Disclosure\nFound by source audit + wall-clock confirmation against 1.8.4 (and verified the same code is\npresent on `main`). Reported privately here; no public disclosure until a fix is available.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-20T21:49:34.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://nvd.nist.gov/vuln/detail/CVE-2026-13311","https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec","https://github.com/ljharb/shell-quote/releases/tag/v1.9.0","https://www.npmjs.com/package/shell-quote","https://github.com/advisories/GHSA-395f-4hp3-45gv"],"source_kind":"github","identifiers":["GHSA-395f-4hp3-45gv","CVE-2026-13311"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-20T22:00:09.023Z","updated_at":"2026-10-26T21:02:11.199Z","epss_percentage":0.0036,"epss_percentile":0.29526,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zOTVmLTRocDMtNDVnds4ABcQ0","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zOTVmLTRocDMtNDVnds4ABcQ0","packages":[{"ecosystem":"npm","package_name":"shell-quote","versions":[{"first_patched_version":"1.9.0","vulnerable_version_range":"\u003c= 1.8.4"}],"purl":"pkg:npm/shell-quote"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zOTVmLTRocDMtNDVnds4ABcQ0/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13N2p3LTc4OXEtM204cM4ABYWb","url":"https://github.com/advisories/GHSA-w7jw-789q-3m8p","title":"shell-quote quote() does not escape newlines in object .op values","description":"### Summary\n\n`shell-quote`'s `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (`\\n`, `\\r`, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal `\\n` as a command separator, so any content after it would execute as a second command.\n\nThe vulnerable code path is reachable in two ways. Neither requires the parser to misbehave — `parse()` only emits ops from a fixed control set — but both are documented API surface:\n\n1. **Direct construction.** A caller builds `{ op: '...\\n...' }` from external input (e.g. a deserialized argument array) and passes it to `quote()`.\n2. **`envFn` return.** `parse(cmd, envFn)` is documented to splice the return value of `envFn` into the result array when it is an object. An attacker-influenced data source consulted by `envFn` can introduce an object token whose `.op` reaches `quote()`.\n\n### Impact\n\nShell command injection in callers that pass object tokens with attacker-influenced `.op` values to `quote()` and then hand the result to a shell. The preconditions are narrower than ordinary string injection — they require the caller to feed object tokens into `quote()` — but object tokens are a public, documented part of the API surface, and `quote()` is intended to be a shell-safety boundary.\n\n### PoC\n\n```js\nconst { parse, quote } = require('shell-quote');\n\n// Direct construction\nquote([{ op: ';\\nid' }]);\n// → \"\\;\\n\\\\i\\\\d\"  ← literal newline; second line executes as a command\n\n// Via parse() with an envFn returning attacker-shaped objects\nconst tokens = parse('echo $X', () =\u003e ({ op: ';\\nid' }));\nrequire('child_process').execSync(quote(tokens), { shell: true });\n// Executes `id` after `echo \\;`.\n```\n\nConfirmed under `sh`, `bash`, `dash`, and `zsh`.\n\n### Patch\n\nFixed by replacing the per-character escape with strict shape validation in `quote()`. The object-token branch now:\n\n- **`{ op }`** — `.op` must be a string from the same allowlist the parser emits (`||`, `\u0026\u0026`, `;;`, `|\u0026`, `\u003c(`, `\u003c\u003c\u003c`, `\u003e\u003e`, `\u003e\u0026`, `\u003c\u0026`, `\u0026`, `;`, `(`, `)`, `|`, `\u003c`, `\u003e`). Anything else throws `TypeError`. This is the direct fix for the reported issue and removes the entire class of `.op` injection.\n- **`{ op: 'glob', pattern }`** — `.pattern` must be a string with no line terminators. Glob metacharacters (`*`, `?`, `[`, `]`, `{`, `}`, `,`) pass through; all other shell-special characters are backslash-escaped. (Previously the pattern field was discarded entirely and the literal string `\\g\\l\\o\\b` was emitted — a latent bug, not security-relevant.)\n- **`{ comment }`** — `.comment` must be a string with no line terminators (line terminators would end the shell comment and resume command parsing — same injection shape).\n- **Any other object shape** — `TypeError`.\n\nThe fix is allowlist-based rather than a targeted regex tweak, so it closes the reported vector and forecloses adjacent ones (U+2028 / U+2029 line separators in `.op`, line terminators in comments, unknown-shape objects coerced through `.replace`).\n\n### Workarounds\n\nPrior to upgrading, callers that build object tokens from untrusted input should validate `.op` against the parser's operator set themselves, and never construct `{ op }` from attacker-controlled strings.\n\n### Credits\n\nReported by Akshat Sinha","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-06-09T14:27:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p","https://nvd.nist.gov/vuln/detail/CVE-2026-9277","https://github.com/ljharb/shell-quote/commit/1518179","https://github.com/ljharb/shell-quote","https://www.npmjs.com/package/shell-quote","http://www.openwall.com/lists/oss-security/2026/05/23/2","https://github.com/advisories/GHSA-w7jw-789q-3m8p"],"source_kind":"github","identifiers":["GHSA-w7jw-789q-3m8p","CVE-2026-9277"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-09T15:00:09.151Z","updated_at":"2026-10-26T21:03:06.173Z","epss_percentage":0.00793,"epss_percentile":0.56088,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13N2p3LTc4OXEtM204cM4ABYWb","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13N2p3LTc4OXEtM204cM4ABYWb","packages":[{"ecosystem":"npm","package_name":"shell-quote","versions":[{"first_patched_version":"1.8.4","vulnerable_version_range":"\u003e= 1.1.0, \u003c= 1.8.3"}],"purl":"pkg:npm/shell-quote"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13N2p3LTc4OXEtM204cM4ABYWb/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nNHJnLTk5M3ItbWd4N84AAqZr","url":"https://github.com/advisories/GHSA-g4rg-993r-mgx7","title":"Improper Neutralization of Special Elements used in a Command in Shell-quote","description":"The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with `exec()`, an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is `[A-z]` instead of the correct `[A-Za-z]`. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-05-24T19:18:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-42740","https://www.npmjs.com/package/shell-quote","https://github.com/ljharb/shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe","https://github.com/ljharb/shell-quote/blob/master/CHANGELOG.md#173","https://github.com/advisories/GHSA-g4rg-993r-mgx7"],"source_kind":"github","identifiers":["GHSA-g4rg-993r-mgx7","CVE-2021-42740"],"repository_url":"https://github.com/ljharb/shell-quote","blast_radius":0.0,"created_at":"2022-12-21T16:12:17.987Z","updated_at":"2026-10-12T12:09:25.060Z","epss_percentage":0.04221,"epss_percentile":0.90507,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNHJnLTk5M3ItbWd4N84AAqZr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nNHJnLTk5M3ItbWd4N84AAqZr","packages":[{"ecosystem":"npm","package_name":"shell-quote","versions":[{"first_patched_version":"1.7.3","vulnerable_version_range":"\u003e= 1.6.3, \u003c= 1.7.2"}],"purl":"pkg:npm/shell-quote"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNHJnLTk5M3ItbWd4N84AAqZr/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnOHAtdjlxNC1naDM0","url":"https://github.com/advisories/GHSA-qg8p-v9q4-gh34","title":"Potential Command Injection in shell-quote","description":"Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.\n\n\n\n## Proof of Concept:\n\nThe following characters are not escaped properly: `\u003e`,`;`,`{`,`}`\n\nBash has a neat but not well known feature known as \"Bash Brace Expansion\", wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible. \n\n```\n   const quote = require('shell-quote').quote;\n   console.log(quote(['a;{echo,test,123,234}']));\n   // Actual                    \"a;{echo,test,123,234}\"\n   // Expected                  \"a\\;\\{echo,test,123,234\\}\"\n   // Functional Equivalent     \"a; echo 'test' '123' '1234'\"\n```\n\n\n\n## Recommendation\n\nUpdate to version 1.6.1 or later.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2019-02-18T23:58:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2016-10541","https://github.com/advisories/GHSA-qg8p-v9q4-gh34","https://www.npmjs.com/advisories/117"],"source_kind":"github","identifiers":["GHSA-qg8p-v9q4-gh34","CVE-2016-10541"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:13:31.356Z","updated_at":"2026-10-27T14:20:21.085Z","epss_percentage":0.02216,"epss_percentile":0.82502,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnOHAtdjlxNC1naDM0","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnOHAtdjlxNC1naDM0","packages":[{"ecosystem":"npm","package_name":"shell-quote","versions":[{"first_patched_version":"1.6.1","vulnerable_version_range":"\u003c 1.6.1"}],"purl":"pkg:npm/shell-quote"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnOHAtdjlxNC1naDM0/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/shell-quote","docker_dependents_count":11803,"docker_downloads_count":4990610265,"usage_url":"https://repos.ecosyste.ms/usage/npm/shell-quote","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/shell-quote/dependencies","status":null,"funding_links":["https://github.com/sponsors/ljharb","https://ko-fi.com/ljharb","https://thanks.dev/ljharb"],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-26T15:01:32.956Z","issues_count":22,"pull_requests_count":14,"avg_time_to_close_issue":33020872.315789472,"avg_time_to_close_pull_request":1087269.888888889,"issues_closed_count":19,"pull_requests_closed_count":9,"pull_request_authors_count":10,"issue_authors_count":16,"avg_comments_per_issue":4.681818181818182,"avg_comments_per_pull_request":1.9285714285714286,"merged_pull_requests_count":7,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":6,"past_year_pull_requests_count":7,"past_year_avg_time_to_close_issue":2539903.4,"past_year_avg_time_to_close_pull_request":1972812.75,"past_year_issues_closed_count":5,"past_year_pull_requests_closed_count":4,"past_year_pull_request_authors_count":6,"past_year_issue_authors_count":5,"past_year_avg_comments_per_issue":1.1666666666666667,"past_year_avg_comments_per_pull_request":0.5714285714285714,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":3,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/ljharb%2Fshell-quote/issues","maintainers":[],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/shell-quote/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/shell-quote/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/shell-quote/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/shell-quote/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/shell-quote/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/shell-quote/codemeta","maintainers":[{"uuid":"ljharb","login":"ljharb","name":null,"email":"ljharb@gmail.com","url":null,"packages_count":569,"html_url":"https://www.npmjs.com/~ljharb","role":null,"created_at":"2022-11-14T10:22:01.289Z","updated_at":"2022-11-14T10:22:01.289Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/ljharb/packages"},{"uuid":"karissa","login":"karissa","name":null,"email":"krmckelv@gmail.com","url":null,"packages_count":172,"html_url":"https://www.npmjs.com/~karissa","role":null,"created_at":"2022-11-14T10:22:01.250Z","updated_at":"2022-11-14T10:22:01.250Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/karissa/packages"},{"uuid":"goto-bus-stop","login":"goto-bus-stop","name":null,"email":"npm@asdf.kooi.me","url":null,"packages_count":337,"html_url":"https://www.npmjs.com/~goto-bus-stop","role":null,"created_at":"2022-11-14T10:22:01.194Z","updated_at":"2022-11-14T10:22:01.194Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/goto-bus-stop/packages"},{"uuid":"jiwaddell","login":"jiwaddell","name":null,"email":"jacob.im.waddell@gmail.com","url":null,"packages_count":1,"html_url":"https://www.npmjs.com/~jiwaddell","role":null,"created_at":"2022-11-14T10:22:01.381Z","updated_at":"2022-11-14T10:22:01.381Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/jiwaddell/packages"}]}