Security vulnerability affects the n8n package. shell-quote's quote() function emits a { comment } token as # followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token.