Is shell-quote 1.7 vulnerable?
npm · 5 releases from 1.7.0 to 1.7.4 · latest shell-quote is 1.12.0 · checked 1 Nov 2026
Yes: 2 known advisories
Yes. shell-quote 1.7.4, the last 1.7 release, is affected by 2 known security advisories (1 critical, 1 high), including CVE-2026-9277, CVE-2026-13311. 1 more affects earlier 1.7.x releases. Upgrade to 1.9.0 or later to fix all of them.
npm install shell-quote@1.9.0Advisories affecting shell-quote 1.7.4
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
- Affected
- <1.9.0
- Fixed in
- 1.9.0
shell-quote quote() does not escape newlines in object .op values
- Affected
- >=1.1.0 <1.8.4
- Fixed in
- 1.8.4
Fixed within 1.7.x, affecting earlier releases
Improper Neutralization of Special Elements used in a Command in Shell-quote
- Affected
- >=1.6.3 <1.7.3
- Fixed in
- 1.7.3
Which of your client projects are still on shell-quote 1.7?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact shell-quote version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other shell-quote versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.