Denial of Service Vulnerability in Shell-Quote by Node.js Vendor

CVE-2026-13311

What is CVE-2026-13311?

The shell-quote library, prior to version 1.8.5, contains a vulnerability that allows an attacker to exploit the parse() function. This function improperly handles parsed tokens, causing significant performance degradation during execution. Specifically, it runs in O(n^2) time complexity based on the number of input tokens, allowing an attacker to input even minimal strings to block the Node.js event loop, thereby leading to a denial of service condition. This vulnerability does not facilitate code execution or data leakage; however, it significantly impacts service availability. The issue has been resolved in version 1.8.5.

References