---
id: shellescape
version: "3.8.1"
license: MIT license
license_treatment: permissive
maintenance: abandoned
---

# shellescape — Shell escape a string to safely use it as a token in a shell command (backport of cPython shlex.quote for Python versions 2.x & < 3.3)

License: permissive · Maintenance: abandoned · Downloads: 1.4M/mo

## What it is and what it does

shellescape is a single-function library that wraps Python strings in shell-safe quoting so they can be safely embedded in shell command lines. It backports `shlex.quote()` to Python 2.x and Python versions before 3.3, making it accessible to projects that need to support those legacy runtimes. The function prevents shell injection attacks by properly escaping metacharacters—turning a dangerous string like `somefile; rm -rf ~` into a quoted token that a shell will treat as literal text rather than as multiple commands.

The package has zero runtime dependencies and installs as a pure Python wheel. It is marked Production/Stable but has been abandoned since 2020; the last commit was in 2021-04-29. No known security vulnerabilities have been reported. With monthly downloads in the top tier, it remains widely used, though most modern projects should consider whether they still need to support the Python versions this backport targets.

Use it for:

- Building shell commands dynamically from untrusted or user-supplied filenames or arguments in Python 2 or early Python 3 codebases.
- Preventing shell injection when passing arguments to subprocess calls that invoke a shell.
- Safely constructing remote SSH commands by quoting local arguments before embedding them in the remote command string.
- Escaping special characters in filenames or paths before passing them to shell utilities via Python scripts on legacy Python versions.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides a `quote()` function that shell-escapes Python strings to safely use them as tokens in shell commands, backporting `shlex.quote()` to older Python versions.

Yes, if you are maintaining Python 2 or Python 3 < 3.3 code that needs to safely escape shell arguments. For modern projects targeting Python 3.3 and later, use the built-in `shlex.quote()` instead. The package is stable and has no known vulnerabilities, but its abandonment means it will not receive updates if shell-escaping semantics change.

## Install

pip install shellescape
uv add shellescape
poetry add shellescape

## Installing shellescape

Before you install: Low friction: pure Python wheel with no runtime dependencies. Maintenance is abandoned—last release was 2020-01-25 and no commits since 2021-04-29—but marked Production/Stable with no known vulnerabilities.

License in practice: MIT license (permissive). No restrictions on commercial or private use; you may modify and distribute freely under the same license terms.

Quickstart:

from shellescape import quote

filename = "somefile; rm -rf ~"
escaped = quote(filename)
command = 'ls -l {}'.format(escaped)
print(command)  # ls -l 'somefile; rm -rf ~'

Verify before relying:

- Whether the backport remains necessary now that Python 2 is end-of-life and Python versions < 3.3 are rarely deployed
- Whether abandonment affects security posture if shell-escaping semantics change in future Python versions
- Current compatibility and testing status across modern Python releases

## Package facts

- License: MIT license (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: abandoned
- Downloads: 1.4M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

shell escape string safely, shell quote command argument, prevent shell injection, shlex quote backport, escape shell metacharacters, safe subprocess command building, shell command injection prevention, shell-safety, legacy-python

[View on SkillFed](https://skillfed.io/packages/shellescape) · [View on PyPI](https://pypi.org/project/shellescape/)