shellescape

What it is and what it does

shellescape is a single-function library that wraps Python strings in shell-safe quoting so they can be safely embedded in shell command lines. It backports `shlex.quote()` to Python 2.x and Python versions before 3.3, making it accessible to projects that need to support those legacy runtimes. The function prevents shell injection attacks by properly escaping metacharacters—turning a dangerous string like `somefile; rm -rf ~` into a quoted token that a shell will treat as literal text rather than as multiple commands.

The package has zero runtime dependencies and installs as a pure Python wheel. It is marked Production/Stable but has been abandoned since 2020; the last commit was in 2021-04-29. No known security vulnerabilities have been reported. With monthly downloads in the top tier, it remains widely used, though most modern projects should consider whether they still need to support the Python versions this backport targets.

Use it for:

• Building shell commands dynamically from untrusted or user-supplied filenames or arguments in Python 2 or early Python 3 codebases.
• Preventing shell injection when passing arguments to subprocess calls that invoke a shell.
• Safely constructing remote SSH commands by quoting local arguments before embedding them in the remote command string.
• Escaping special characters in filenames or paths before passing them to shell utilities via Python scripts on legacy Python versions.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides a `quote()` function that shell-escapes Python strings to safely use them as tokens in shell commands, backporting `shlex.quote()` to older Python versions.

Yes, if you are maintaining Python 2 or Python 3 < 3.3 code that needs to safely escape shell arguments. For modern projects targeting Python 3.3 and later, use the built-in `shlex.quote()` instead. The package is stable and has no known vulnerabilities, but its abandonment means it will not receive updates if shell-escaping semantics change.

Install

shellescape on PyPI

pip install shellescape

uv add shellescape

poetry add shellescape

Installing shellescape

Before you install

Low friction: pure Python wheel with no runtime dependencies. Maintenance is abandoned—last release was 2020-01-25 and no commits since 2021-04-29—but marked Production/Stable with no known vulnerabilities.

License in practice

MIT license (permissive). No restrictions on commercial or private use; you may modify and distribute freely under the same license terms.

Quickstart

from shellescape import quote

filename = "somefile; rm -rf ~"
escaped = quote(filename)
command = 'ls -l {}'.format(escaped)
print(command)  # ls -l 'somefile; rm -rf ~'

Verify before relying

• Whether the backport remains necessary now that Python 2 is end-of-life and Python versions < 3.3 are rarely deployed
• Whether abandonment affects security posture if shell-escaping semantics change in future Python versions
• Current compatibility and testing status across modern Python releases

Package facts

Evidence: shellescape-3.8.1-py2.py3-none-any.whl

Keywords: shell, quote, escape, backport, command line, command, subprocess

Tags

More Utilities packages