shell-quote CVE-2026-13311

Exploitation requires that the application passes an attacker-controlled string into a code path that calls shell-quote's parse() function on a version prior to 1.8.5 - that dependency-and-data-flow condition is the real prerequisite, not any product configuration flag. No shell metacharacters, authentication (PR:N), or user interaction (UI:N) are needed, and ordinary space-separated words suffice, so where untrusted input reaches parse() this is remotely and unauthenticatedly triggerable. The principal limiting factor is reachability: if an application only invokes parse() on trusted, length-bounded internal data, or never exposes parse() to external input, the vulnerability is effectively unexploitable despite the high CVSS availability score. Impact is confined to availability (event-loop stall) - no code execution or data exposure is possible.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with VA:H (high availability impact) and no confidentiality or integrity impact, yielding the reported 8.7 score - high specifically because availability damage is easy and unconditional. However, real-world priority should be tempered: there is no EPSS score, no KEV listing, and no POC referenced in the input, and the actual blast radius depends entirely on whether a given application feeds untrusted external input into parse(). The 'RCE' tag in the intelligence source directly conflicts with the description, which explicitly states there is no code execution or data disclosure - treat the RCE tag as inaccurate and rely on the VA:H/availability-only assessment. This is a genuine but bounded DoS: dangerous for services that parse user-supplied strings on the request path, low concern for applications that only call parse() on trusted, bounded internal input.

An attacker identifies a web endpoint or API that forwards a user-supplied field (for example a search string, filename, or command argument) into a shell-quote parse() call. They submit a single small request containing a long run of space-separated words; the quadratic parsing pins a CPU core and blocks the Node.js event loop, freezing all concurrent requests on that instance. No public exploit code is identified at time of analysis, but the trigger is trivial to construct and requires no authentication or special characters.