Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ljharb/shell-quote
main @ db09fc7
3
Fixes
2
CVEs
CRITICAL
Peak severity
Highlights
Command Injection: 2 prior fixes. Scrutinize any change in this area.
index.js: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The use of broad or incorrect regex character ranges like '[A-z]' to match Windows drive letters inadvertently matched critical shell control characters like backticks, creating a command injection bypass route when the output is evaluated in a shell context.
Command Injection: Line terminators within object-token shapes could bypass escaping in the quoting function, allowing attackers to terminate the current shell statement and append malicious commands.
Denial of Service: An O(n²) quadratic-time complexity issue in the parse reducer allowed attackers to exhaust CPU resources using relatively small payload sizes.