CVE-2026-13311

Aliases:GHSA-395f-4hp3-45gv
Advisory lineage Upstream: 0 Downstream: 5
PUBLISHED
Published: 25 Jun 2026, 04:48
Last modified:25 Jun 2026, 12:49

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.7 HIGH
v4.0 (cve.org)
EPSS Score
0.36% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Jun 2026, 04:48
Published
Vulnerability first disclosed
25 Jun 2026, 12:49
Last Modified
Vulnerability information updated

Description

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.36%• Percentile: 28%

Techniques & Countermeasures

  • CWE-407•Inefficient Algorithmic Complexity

    An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Systems

  • ljharb•shell-quote

    ≤ 1.8.4

  • Npm•shell-quote

    < 1.9.0

References (6)