CVE mentions, exploit signals, and PoC evidence in one fast public view.
Vendor/product archive
3 CVEs tagged to shell-quote_project / shell-quote — 2 Critical, 1 High, 0 Medium, 0 Low, 0 Unrated.
shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every…
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive…
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vuln…