Jordan Harband

**Name of the Vulnerable Software and Affected Versions** shell-quote versions prior to 1.8.4 **Description** The `quote()` function fails to validate object-token inputs against the operator model used by `parse()`. Specifically, the `.op` field is escaped using a regular expression that does not match line terminators such as ` `, `r`, `U+2028`, and `U+2029`. This allows line terminators to pass unescaped into the output. Since POSIX shells treat literal newlines as command separators, any content following the newline is executed as a separate command, leading to command injection. This issue is reachable through the direct construction of `{ op: '... ...' }` from external input or via `parse(cmd, envFn)` when `envFn` returns object tokens with an attacker-influenced `.op` field. **Recommendations** Update to version 1.8.4 or later. As a temporary workaround, restrict external input from influencing the `.op` field in object tokens passed to the `quote()` function or returned by `envFn` in the `parse()` function.

**Name of the Vulnerable Software and Affected Versions** Lodash versions 4.0.0 through 4.17.22 **Description** Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the ` .unset` and ` .omit` functions. An attacker can leverage crafted paths to trigger the deletion of methods from global prototypes. The issue allows for property deletion but does not permit modification of the original behavior of those properties. **Recommendations** Update to Lodash version 4.17.23 or later.