Is shell-quote 1.6 vulnerable?
npm · 4 releases from 1.6.0 to 1.6.3 · latest shell-quote is 1.12.0 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. shell-quote 1.6.3, the last 1.6 release, is affected by 3 known security advisories (2 critical, 1 high), including CVE-2026-9277, CVE-2021-42740, CVE-2026-13311. 1 more affects earlier 1.6.x releases. Upgrade to 1.9.0 or later to fix all of them.
npm install shell-quote@1.9.0Advisories affecting shell-quote 1.6.3
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
- Affected
- <1.9.0
- Fixed in
- 1.9.0
shell-quote quote() does not escape newlines in object .op values
- Affected
- >=1.1.0 <1.8.4
- Fixed in
- 1.8.4
Improper Neutralization of Special Elements used in a Command in Shell-quote
- Affected
- >=1.6.3 <1.7.3
- Fixed in
- 1.7.3
Fixed within 1.6.x, affecting earlier releases
Potential Command Injection in shell-quote
- Affected
- <1.6.1
- Fixed in
- 1.6.1
Which of your client projects are still on shell-quote 1.6?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact shell-quote version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other shell-quote versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.