← All credits

Jordan Harband (@ljharb)

2 vulnerability records and advisories credit this contributor.

CVE-2026-102422
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
CVE-2026-9277
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`