## What
`shell-quote <= 1.8.3` is affected by
[GHSA-w7jw-789q-3m8p](https://github.com/advisories/GHSA-w7jw-789q-3m8p)
/ CVE-2026-9277 (**critical**): `quote()` backslash-escapes `.op`
characters with `/(.)/g`, which doesn't match line terminators (`\n`,
`\r`, U+2028/2029). A line terminator in an object token's `.op` value
passes through unescaped, and POSIX shells treat a literal `\n` as a
command separator — enabling shell command injection in callers that
pass attacker-influenced object tokens to `quote()`. First patched in
**1.8.4**.
This is Dependabot alert #1434 on the root `yarn.lock`.
## How
The root lockfile resolved two vulnerable versions:
- `1.8.1` — via the `^1.6.1` / `^1.7.3` / `^1.8.1` ranges
- `1.8.3` — **hard-pinned** by `concurrently@9.2.1` (used in
`twenty-companion`)
`yarn up -R shell-quote` only re-resolves the ranged dependents; the
exact `1.8.3` pin from `concurrently` stays. So I added a `shell-quote:
"^1.8.4"` entry to root `resolutions`, matching the existing `tmp` /
`chokidar` / `tar` security overrides. Every consumer now resolves to
the patched `1.8.4`.
## Scope
- `package.json`: +1 resolution line.
- `yarn.lock`: two vulnerable entries collapse to a single
`shell-quote@1.8.4`.
- `1.8.4` is a semver-compatible patch over `1.8.3`; latest
`concurrently` (10.x) already depends on `1.8.4`.
- Verified no `shell-quote <= 1.8.3` remains in any lockfile across the
repo.
Charles Bochet
bd084afc11