CVE-2026-13311: shell-quote Algorithmic Denial of Service Vulnerability

Technical summary

The vulnerability resides in the parse() function of shell-quote versions prior to 1.8.5. The function uses Array.prototype.concat within a reduce operation to accumulate parsed tokens, resulting in O(n²) time complexity. Each iteration reallocates and copies the entire array, causing quadratic degradation in performance. An attacker can exploit this algorithmic inefficiency by sending a large volume of space-separated tokens (no shell metacharacters required) to trigger extended event loop blocking in single-threaded Node.js environments. The CWE classification (CWE-407: Inefficient Algorithmic Complexity) reflects the root cause.

Business impact

Applications relying on shell-quote for command parsing are vulnerable to denial of service attacks. Service availability can be degraded or entirely lost if an attacker submits moderately sized inputs designed to trigger the O(n²) behavior. This is particularly concerning for services that expose parse() to untrusted user input (e.g., CLI tools, API backends, or middleware processing shell commands). Unlike vulnerabilities with code execution risk, this threat is primarily operational; however, sustained unavailability can disrupt business continuity and user access.

Affected systems

The shell-quote project is affected in all versions prior to 1.8.5. Any Node.js application directly using the shell-quote library with untrusted input is at risk. The vulnerability is not version-specific to Node.js itself but requires the vulnerable shell-quote library to be installed as a dependency.

Exploitability

Exploitability is high from a practical standpoint. No authentication, special privileges, or complex exploitation techniques are required. An attacker needs only the ability to supply input to a code path that calls parse()—input can be as simple as space-separated words without any shell metacharacters. The attack is network-accessible if the parse() function is exposed through a web service or API. Crafting a proof-of-concept payload requires minimal effort: a sufficiently large string of space-separated tokens will reliably trigger the denial of service.

Remediation

Upgrade shell-quote to version 1.8.5 or later, which contains the algorithmic fix. Verify that your application's dependency tree reflects the patched version. For development and staging environments, prioritize testing the upgrade to ensure no breaking changes affect your application's shell command parsing logic. Monitor package.json and lock files to prevent accidental downgrades.

Patch guidance

Update the shell-quote dependency in your Node.js project immediately. If using npm, run `npm install shell-quote@latest` or manually update your package.json to shell-quote version 1.8.5 or later and run `npm install`. Verify the update with `npm list shell-quote`. If shell-quote is a transitive dependency (pulled in by another package), check that your application's lock file (package-lock.json or yarn.lock) reflects the updated version. Test the application thoroughly in a staging environment before deploying to production.

Detection guidance

Monitor Node.js application logs and performance metrics for signs of event loop blocking. Look for requests that take unusually long to complete or server unresponsiveness correlated with specific input patterns (large strings with many tokens). Consider instrumenting your application with performance monitoring tools to detect sudden spikes in parse() execution time. If you have access to input logs, search for patterns of repeated space-separated tokens or unusually long command strings submitted to your application. Review application dependencies regularly to identify any remaining use of vulnerable shell-quote versions.

Why prioritize this

Although the CVSS score of 7.5 reflects a high severity rating, the practical risk depends on your specific architecture. Prioritize patching if your application exposes shell-quote parsing to the internet or to untrusted internal users. If shell-quote is used only for parsing trusted, developer-controlled input, the risk is lower but still warrants remediation. Single-threaded services are more vulnerable than load-balanced or multi-process deployments because a single malicious request can block the entire service.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an attack vector that is network-accessible (AV:N), requires no authentication or user interaction (PR:N, UI:N), and has a high impact on availability (A:H). However, confidentiality and integrity are not affected (C:N, I:N). The score accurately captures the severity of a denial-of-service condition but does not account for mitigating factors such as rate limiting, input validation, or architectural redundancy that may reduce real-world risk in your specific deployment.

Frequently asked questions