How many shell-quote project shell-quote CVEs are in CISA KEV?

None of shell-quote project shell-quote's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for shell-quote project shell-quote vulnerabilities?

Yes — 1 of shell-quote project shell-quote's CVEs have a known public exploit.

Which versions of shell-quote project shell-quote are affected?

6 distinct shell-quote project shell-quote versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in shell-quote project shell-quote CVEs?

shell-quote project shell-quote's CVEs most often map to these CWE weakness types: CWE-407 (Inefficient Algorithmic Complexity), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')).

How many critical shell-quote project shell-quote vulnerabilities are there?

shell-quote project shell-quote has 2 critical and 1 high-severity CVEs.

What is the average severity of shell-quote project shell-quote CVEs?

The average CVSS base score across shell-quote project shell-quote's scored CVEs is 9.4.

RadicalNotion.AI

Log in Start free

shell-quote project

3 CVEs

shell-quote project shell-quote Vulnerabilities

Name: shell-quote project shell-quote vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for shell-quote by shell-quote project.

3

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

1

Public exploits

PoC or exploit code

9.4

Avg CVSS

2018–2026

Last updated June 25, 2026

Overview

shell-quote project shell-quote has 3 published CVE records since 2018, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 9.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting shell-quote project shell-quote, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of shell-quote project shell-quote's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High1

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of shell-quote project shell-quote's CVEs are currently listed in CISA's KEV catalog.

Public exploits

1

One of shell-quote project shell-quote's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every shell-quote project shell-quote version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 1.6.11 CVE
< 1.7.31 CVE
< 1.9.01 CVE

Fixed in

1.6.11 CVE
1.7.31 CVE
1.9.01 CVE

Find a version

3 CVEs

Sort

shell-quote parse() is quadratic in token count, enabling denial of service
CVE-2026-13311
Public exploit
Patch
CWE-407
High · CVSS 8.7
EPSS 0.4% (29th pct)2026-06-25
Critical vulnerability · 2021-10-21
CVE-2021-42740
Patch
Critical · CVSS 9.8
EPSS 4.2% (90th pct)2021-10-21
Critical vulnerability · 2018-05-31
CVE-2016-10541
Patch
CWE-78
Critical · CVSS 9.8
EPSS 2.2% (82th pct)2018-05-31

Common weakness types

The CWE weakness categories most often found in shell-quote project shell-quote CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many shell-quote project shell-quote CVEs were published each year.

2018

1

2021

1

2026

1

Other shell-quote project products

Browse vulnerabilities for other products by shell-quote project.

All shell-quote project vulnerabilities

Frequently asked questions

Common questions about shell-quote project shell-quote vulnerabilities.

How many CVEs does shell-quote project shell-quote have?: shell-quote project shell-quote has 3 published CVE records since 2018.
How many shell-quote project shell-quote CVEs are in CISA KEV?: None of shell-quote project shell-quote's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for shell-quote project shell-quote vulnerabilities?: Yes — 1 of shell-quote project shell-quote's CVEs have a known public exploit.
Which versions of shell-quote project shell-quote are affected?: 6 distinct shell-quote project shell-quote versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in shell-quote project shell-quote CVEs?: shell-quote project shell-quote's CVEs most often map to these CWE weakness types: CWE-407 (Inefficient Algorithmic Complexity), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')).
How many critical shell-quote project shell-quote vulnerabilities are there?: shell-quote project shell-quote has 2 critical and 1 high-severity CVEs.
What is the average severity of shell-quote project shell-quote CVEs?: The average CVSS base score across shell-quote project shell-quote's scored CVEs is 9.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track shell-quote project shell-quote vulnerabilities

Monitor new shell-quote project shell-quote vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing