Skip to main content

shell-quote CVE-2026-13311

| EUVDEUVD-2026-39180 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2026-06-25 7ffcee3d-2c14-4c3e-b844-86c6a321a158 GHSA-395f-4hp3-45gv
RCE Denial Of Service Node.js Red Hat Suse Shell Quote Shell Quote Project
8.7
CVSS 4.0 · Vendor: 7ffcee3d-2c14-4c3e-b844-86c6a321a158
Share

Severity by source

Vendor (7ffcee3d-2c14-4c3e-b844-86c6a321a158) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Remote, low-complexity, unauthenticated trigger via plain input with no user interaction; impact is availability-only event-loop blocking, so C:N/I:N and A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (7ffcee3d-2c14-4c3e-b844-86c6a321a158).

CVSS VectorVendor: 7ffcee3d-2c14-4c3e-b844-86c6a321a158

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 25, 2026 - 05:32 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 776 npm packages depend on shell-quote (14 direct, 763 indirect)

Ecosystem-wide dependent count for version 1.9.0.

DescriptionCVE.org

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.

AnalysisAI

Denial of service in the shell-quote Node.js library (versions prior to 1.8.5) lets remote attackers stall the single-threaded event loop by passing an attacker-controlled string into any code path that calls parse(). The flaw is purely algorithmic - parse() builds its token list with Array.prototype.concat as a reduce accumulator, giving O(n^2) behavior so even a small payload of plain space-separated words causes disproportionate CPU consumption. There is no public exploit identified at time of analysis and no KEV listing; impact is to availability only with no code execution or data disclosure despite the misleading 'RCE' source tag.

Technical ContextAI

shell-quote is a popular npm utility that parses and quotes shell command strings in Node.js applications, commonly used to safely build or interpret command lines. The root cause is CWE-407 (Inefficient Algorithmic Complexity): inside parse(), parsed tokens are finalized using Array.prototype.concat as the accumulator of a reduce() call. Because concat returns a new array each iteration, the entire growing result array is reallocated and copied on every token, producing quadratic O(n^2) time relative to the number of input tokens. Notably no shell metacharacters are required to trigger the pathological path - ordinary whitespace-separated words are sufficient - so any input length sanitization based on metacharacter filtering provides no protection. The single-threaded nature of the Node.js event loop means this CPU spike blocks all other request processing for the duration.

RemediationAI

Vendor-released patch: upgrade shell-quote to version 1.8.5 or later, which replaces the quadratic concat-based accumulator; this is the primary and complete fix and should be applied directly and via transitive dependency overrides (npm 'overrides' or yarn 'resolutions') since shell-quote is frequently pulled in indirectly. Verify and remediate using the advisory at https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv and confirm the resolved version on https://www.npmjs.com/package/shell-quote. If immediate upgrade is not possible, apply input-size limits before calling parse() - cap the maximum length and token count of any untrusted string reaching parse() (note the trade-off: legitimate long command strings will be rejected) - and where feasible move parse() calls off the main request path or into a worker thread so a slow parse cannot block the shared event loop. Filtering shell metacharacters is NOT an effective workaround because plain space-separated words trigger the issue.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-59094 HIGH POC
8.7
CVE-2026-71321 HIGH POC
7.5
CVE-2026-59887 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2024-9631 HIGH POC
7.5
CVE-2026-27903 HIGH POC
7.5
CVE-2026-3988 HIGH POC
7.5
CVE-2026-45186 HIGH POC
7.5

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-13311 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy