diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce01f93fa..1768af42e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Upgraded `shell-quote` to `^1.10.0` to address CVE-2026-13311. [#1469](https://github.com/sourcebot-dev/sourcebot/pull/1469)
+
 ## [5.1.3] - 2026-07-20
 
 ### Added
diff --git a/yarn.lock b/yarn.lock
index 54653dc8d..85a70f916 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -21946,9 +21946,9 @@ __metadata:
   linkType: hard
 
 "shell-quote@npm:^1.6.1, shell-quote@npm:^1.8.4":
-  version: 1.8.4
-  resolution: "shell-quote@npm:1.8.4"
-  checksum: 10c0/86c93678bc394cb81f5ddcdc87df9c95d279ef9652775cd1cd1eed361404169a8d8cbaacaeed232ab09919e36ee1e5363863570390d78571f8c22b7f6312fb40
+  version: 1.10.0
+  resolution: "shell-quote@npm:1.10.0"
+  checksum: 10c0/46ee59bfd972ce6a45500c44ed130dff2d0a7d6fbac9841e59d548518cad8060a06393c9a5dcbc0cede294ad80b2a2cd8c904679e09265f53efc0a0879f30961
   languageName: node
   linkType: hard