chore(deps): update dependency shell-quote to v1.11.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
shell-quote	1.9.0 → 1.11.0

---

shell-quote: quote() command injection via a line terminator in a token after a { comment } token

CVE-2026-102422 / GHSA-pqg4-j6r4-53mv

More information

Details

Impact

quote() emits a { comment } token as # followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input:

quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#']);
// echo ok #x 'a
// id;#'

Passed to sh, bash, dash, ksh, or zsh, this runs id.

parse() emits a comment token for a # in the middle of a word (for example http://example.com/#frag), so callers that combine parse() output with another untrusted string, such as quote(parse(untrustedCommand).concat(untrustedArg)), are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it.

Exploitation requires an attacker-controlled string containing a line terminator that follows a { comment } token in the same quote() call.

Patches

Fixed in v1.11.0: quote() throws a TypeError when a string after a { comment } token contains a line terminator (\n, \r, U+2028, or U+2029).

Workarounds

Drop every token after a { comment } token before calling quote(), or reject line terminators in untrusted strings. Separately, do not append other shell text after quote() output that contains a comment, since the comment swallows it.

Severity

• CVSS Score: 9.2 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv
• https://nvd.nist.gov/vuln/detail/CVE-2026-102422
• https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc
• https://github.com/advisories/GHSA-pqg4-j6r4-53mv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ljharb/shell-quote (shell-quote)

v1.11.0

Compare Source

Fixed

• [Refactor] quote: drop a replace that can never match in the single-quote branch #15
• [New] parse: support bash ANSI-C quoting ($'...') #32

Commits

• [Fix] quote: reject line terminators in tokens after a comment 6002b2e
• [Fix] parse: preserve text after special shell parameters 81b08a5
• [Fix] parse: an escaped backslash does not escape the character after it d708019
• [Fix] quote: preserve ! in arguments that also contain ' ad39927
• [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
• [Fix] quote: preserve empty glob patterns 35c9b97
• [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
• [meta] npmignore some files ebfc308
• [actions] add permissions 3429b0d
• [actions] set least-privilege cache-mode 36f2394
• [Dev Deps] update eslint 6de9a41

v1.10.0

Compare Source

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions #1

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
• [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
• [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#​11) 1c36f3f
• [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
• [readme] document parse's supported parameter-expansion subset e1c75cd
• [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
• [readme] fix stale example outputs 2de86f5
• [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#​14) 190e236
• [readme] quote: use output verbatim; do not re-quote it (#​11) 1b36468
• [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
• [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
• [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
• [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
• [Tests] quote: the tilde test escapes every ~, not just a leading one (#​9) 617d119

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review-active

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: Zoo-Code-Org/Zoo-Code/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5747c927-bd41-4f17-a59c-ccab308c5296

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Review status

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

Current step: Awaiting fresh human maintainer or CODEOWNER approval.

Review-state labels are managed by this workflow; do not edit them manually. community-approved is managed the same way — do not add or remove it manually. It signals a fresh community code approval for the current head as an advisory priority only; maintainer review is still required.