The vulnerability in the shell-quote library arises from its `quote()` function not validating the shape of object-token inputs. When an object token contains a `.op` field with line terminators such as newline or Unicode paragraph separators, those characters are not escaped by the per‑character backslash escape logic. POSIX shells interpret a literal newline as a command separator, so any text following the newline is executed as a separate command. This flaw allows an attacker to inject malicious commands that the shell will run, leading to complete compromise of the system running the Node.js process. The weakness corresponds to CWE‑77 and CWE‑78 for input that influences command execution.

Any Node.js application that depends on the shell-quote npm package and uses its documented APIs—either the `quote()` function or the `parse(cmd, envFn)` helper—is vulnerable. The bug exists in all versions of shell‑quote released before the security‑fix commit 1518179, which introduced strict validation of the `.op` field. All applications that receive external data that could construct an object token, or that call `parse` with an `envFn` that may supply attacker‑influenced tokens, are affected.

The CVSS score of 9.2 indicates a high‑severity vulnerability, with most conditions for exploitation already satisfied: the flaw is in a widely used npm package, it is reachable through documented interfaces, and it can be triggered without any special privileges. The EPSS score is unavailable, but the absence of a KEV listing does not mitigate the potential for exploitation, especially given the public nature of the vulnerable code. An attacker with the ability to influence the input to `quote()` or `parse()`—for example by supplying a crafted environment variable or API payload—can inject newline characters and execute arbitrary shell commands. The attack vector is likely local to the Node.js runtime, though it could be triggered by network input if the application processes untrusted data. The environment in which the Node process runs determines the scope of the compromise; if the process runs with elevated privileges, the attacker may gain full system control.