CVE-2026-13311 shell-quote parse() is quadratic in token count, enabling denial of service
An attacker can cause a denial of service by supplying a crafted string to shell-quote's parse function, blocking the Node.js event loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13311?
CVE-2026-13311 is a high-severity denial of service vulnerability in ljharb shell-quote, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.
Weakness: CWE-407
Which versions are affected by CVE-2026-13311?
2 open source packages ship an affected version, including shell-quote. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shell-quote npm | All versions | 1.9.0 |
shell-quote npm | All versions | 1.9.0 |
Linux distribution packages (1)
agama-web-ui openSUSE:Tumbleweed | All versions | 23+75.1a877fb50-50.1 |
Products include Shell-Quote Project Shell-Quote.
How do I fix CVE-2026-13311?
Upgrade shell-quote to 1.9.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-13311 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-13311 exists.
Other vulnerabilities in ljharb shell-quote
Sources
Also known as CLEANSTART-2026-AC35633, CLEANSTART-2026-XS33213, CLEANSTART-2026-ZX58029, CLSA-2026-1791584881, DEBIAN-CVE-2026-13311, ECHO-3f83-8535-51d8 and 15 more.