shell-quote

quote and parse shell commands

Latest 1.12.0

NPM

88%

Total Score

healthy

Healthy release with active maintenance; concentrated recent commits and one workflow hygiene issue are minor caveats.

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the concentrated recent commit activity carries more continuity weight.

Repo bus factor

Four contributors were active recently, but the top contributor made 88% of commits. That concentration is a modest continuity concern for this user-owned project.

Workflow audit

All 7 workflows were analyzed with no high- or medium-severity findings, and 6 use read-only permissions. The audit found one high-confidence low-severity adhoc-packages issue, and all 16 action references are unpinned, so workflow hygiene is not perfect.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-972994 shell-quote is vulnerable to OS Command Injection in versions 1.8.4 - 1.10.0.	1.8.4 - 1.10.0	High
AIKIDO-2026-245392 shell-quote is vulnerable to Denial of Service (DoS) in versions 0.0.0 - 1.8.4.	0.0.0 - 1.8.4	High
CVE-2026-9277 shell-quote is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 1.1.0 - 1.8.3.	1.1.0 - 1.8.3	High
CVE-2021-42740 shell-quote is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 1.6.3 - 1.7.2.	1.6.3 - 1.7.2	Critical
CVE-2016-10541 shell-quote is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 1.6.1.	0.0.0 - 1.6.1	Critical