shell-quote 1.8.0

Direct Vulnerabilities

Known vulnerabilities in the shell-quote package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Inefficient Algorithmic Complexity shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `parseInternal` function of `parse.js`, where `parse()` finalizes the token list with `Array.prototype.concat` inside a `reduce`, copying the entire growing array on every iteration for O(n²) behavior. An attacker can block the single-threaded Node.js event loop and sustain a denial of service by passing a large space-separated string to any code path that calls `parse()`, with roughly 128 KB stalling the loop for about 15 seconds and 256 KB for about 57 seconds. How to fix Inefficient Algorithmic Complexity? Upgrade `shell-quote` to version 1.9.0 or higher.	<1.9.0
C Arbitrary Command Injection shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Arbitrary Command Injection via the `quote()` function when object-token inputs containing line terminators (`\n`, `\r`, `U+2028`, `U+2029`) in the `.op` field are not properly validated. An attacker can execute arbitrary commands by supplying crafted input that includes line terminators, which are interpreted as command separators by POSIX shells. The vulnerable path is reachable in two ways: by direct construction from external input (`{ op: '...\n...' }`) or by untrusted input being passed to `parse(cmd, envFn)` by `envFn`. How to fix Arbitrary Command Injection? Upgrade `shell-quote` to version 1.8.4 or higher.	>=1.1.0 <1.8.4

Vulnerability

Vulnerable Version

Inefficient Algorithmic Complexity

shell-quote is a package used to quote and parse shell commands.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parseInternal function of parse.js, where parse() finalizes the token list with Array.prototype.concat inside a reduce, copying the entire growing array on every iteration for O(n²) behavior. An attacker can block the single-threaded Node.js event loop and sustain a denial of service by passing a large space-separated string to any code path that calls parse(), with roughly 128 KB stalling the loop for about 15 seconds and 256 KB for about 57 seconds.

How to fix Inefficient Algorithmic Complexity?

Upgrade shell-quote to version 1.9.0 or higher.

<1.9.0

Arbitrary Command Injection

shell-quote is a package used to quote and parse shell commands.

Affected versions of this package are vulnerable to Arbitrary Command Injection via the quote() function when object-token inputs containing line terminators (\n, \r, U+2028, U+2029) in the .op field are not properly validated. An attacker can execute arbitrary commands by supplying crafted input that includes line terminators, which are interpreted as command separators by POSIX shells. The vulnerable path is reachable in two ways: by direct construction from external input ({ op: '...\n...' }) or by untrusted input being passed to parse(cmd, envFn) by envFn.

How to fix Arbitrary Command Injection?

Upgrade shell-quote to version 1.8.4 or higher.

>=1.1.0 <1.8.4

shell-quote@1.8.0

quote and parse shell commands

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically