CVE-2016-10541: Potential Command Injection in shell-quote
Summary
CVE-2016-10541: Potential Command Injection in shell-quote. Affects shell-quote versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shell-quote package is an npm package used for escaping command line arguments. It is commonly used to prevent command injection attacks by properly escaping user input. However, affected versions of shell-quote do not properly escape certain characters, such as >, ;, {, and }, which may result in command injection if the library is used to escape user input destined for use as command line arguments.
Vulnerability Detail
The vulnerability in shell-quote arises from the improper escaping of command line arguments. This allows an attacker to inject arbitrary commands into the command line, potentially leading to unauthorized access, data loss, or other malicious activities. The vulnerability is considered critical with a CVSS score of 9.8. The specific issue is related to the lack of proper escaping for characters like >, ;, {, and }. This can be exploited using a technique called "Bash Brace Expansion", which allows the execution of sub-commands without spaces by enclosing them in {} and using , as the argument separator. By injecting malicious commands, an attacker can execute arbitrary code on the system.
How To Fix
Latest published version: 1.12.0 as of 22 Oct 2026
npm install shell-quote@1.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
npm install shell-quote@1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately possible, a workaround can be implemented by manually escaping the problematic characters before passing user input to the shell-quote library. For example, instead of directly passing a;{echo,test,123,234} as an argument, it can be escaped as a\;\{echo,test,123,234\}. This ensures that the characters are treated as literal values and not interpreted as command separators or expansions.
Conclusion
The shell-quote package is vulnerable to command injection due to improper escaping of command line arguments. This can be exploited by an attacker to execute arbitrary commands on the system. To mitigate this vulnerability, it is recommended to update to version 1.6.1 or later of the package. If immediate update is not possible, manual escaping of problematic characters can be used as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shell-quote →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access, data loss, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, updating to version 1.6.1 or later of the shell-quote package fixes this vulnerability by properly escaping command line arguments.
Yes, you can manually escape the problematic characters before passing user input to the shell-quote library. This ensures that the characters are treated as literal values and not interpreted as command separators or expansions.
There are no known public exploits for this vulnerability at the moment. However, it is important to update to the latest version or apply the recommended workarounds to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for shell-quote.
