Possible fix(deps): shell-quote 1.8.3 → 1.8.4 (CVE-2026-9277) in package-lock.json

[begininvoke]

This might be a false positive, but package-lock.json around line 8498 looked worth a second pair of eyes.

shell-quote 1.8.3's quote() function escapes .op fields character‑by‑character, which leaves line terminators unescaped. An attacker can embed a newline in the .op field (via direct object or envFn) to break out of quoting, causing the shell to treat subsequent input as a separate command. This leads to arbitrary command execution. Upgrade to version 1.8.4, which validates .op against a strict allowlist and rejects line terminators.

Something like this might fix it:

--- a/package-lock.json
+++ b/package-lock.json
@@ -8495,7 +8495,7 @@
           "node_modules/shell-quote": {
             "version": "1.8.3",
             "resolved": "..."
           }
         }
--- a/package.json
+++ b/package.json
@@ -1,4 +1,4 @@
   "name": "my-app",
   "version": "1.0.0",
   "dependencies": {
-    "shell-quote": "1.8.3",
+    "shell-quote": "1.8.4"
   }
 }

For reference: rule CVE-2026-9277. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.