SH
Product
shell-quote
2
CVEs
0
On KEV
8.1
Max CVSS
1
New 30D
Severity mix
Critical 0High 2Medium 0Low 0
Watch
Add shell-quote to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102422 | 8.1 | Sep 29 | shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token Affected: 1.8.4 before 1.11.0 |
| CVE-2026-9277 | 8.1 | May 22 | shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op` Affected: 1.1.0 before 1.8.4 |
Showing 2