shell-quote 1.8.3 has CVE-2026-9277 — recommend upgrade

[lonelyastronaut1223]

Summary

claude-mem versions 13.4.0 through 13.6.1 depend on shell-quote==1.8.3, which has CVE-2026-9277 (quote() does not escape newlines in object .op values).

Affected paths

<version>/package.json:34 across every currently-shipped version I could see:

• 13.4.0 / 13.4.1 / 13.4.2 / 13.5.5 / 13.5.6 / 13.6.0 / 13.6.1

Impact

Low-to-medium. The vulnerability only triggers when user-supplied data containing newlines is passed through shell-quote's op operand. Most code paths in claude-mem probably don't expose that shape, but a defense-in-depth bump is cheap.

Suggested fix

Bump shell-quote from 1.8.3 to whatever the current patched release is (1.8.4+ at the time of writing), then ship a new minor.

— flagged via NVIDIA SkillSpector scan during a personal Claude Code plugin audit on 2026-06-16

[h1rot]

Confirming this is still present in the latest published release 13.10.2 (checked 2026-07-11), not just 13.4.0–13.6.1 — shell-quote@^1.8.3 remains in the dependency set.

One additional detail worth flagging: per the npm package metadata, shell-quote is esbuild-inlined into the shipped worker/server/npx bundles, so the vulnerable quote() code is baked into the distributed artifacts rather than being a devDependency end users can override with their own lockfile bump. A version bump + republish is therefore needed to remediate for already-installed users.

Fix is unchanged: bump shell-quote to 1.8.4+ (GHSA-w7jw-789q-3m8p, CVSS 8.1) and ship a new release.

— re-confirmed via NVIDIA SkillSpector during a Claude Code plugin audit, 2026-07-11