CVE-2026-13311: shell-quote DOS Vulnerability

CVE-2026-13311 Overview

CVE-2026-13311 affects the shell-quote npm package in versions prior to 1.8.5. The parse() function finalizes parsed tokens using Array.prototype.concat as a reduce accumulator. This pattern reallocates and copies the entire growing array on every iteration, producing O(n²) time complexity relative to input token count. An attacker who supplies an attacker-controlled string to any code path calling parse() can block the single-threaded Node.js event loop with a small input. No shell metacharacters are required since plain space-separated words trigger the slowdown. The flaw is tracked under CWE-407: Algorithmic Complexity.

Critical Impact
A remote, unauthenticated attacker can stall the Node.js event loop with a small crafted string, producing a denial of service. Impact is limited to availability with no code execution or data disclosure.

Affected Products

shell-quote npm package versions prior to 1.8.5
Node.js applications that invoke shell-quote.parse() on untrusted input
Downstream packages and services that depend on vulnerable shell-quote releases

Discovery Timeline

2026-06-25 - CVE-2026-13311 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-13311

Vulnerability Analysis

The vulnerability resides in the parse() function of shell-quote, a widely used library for parsing and quoting shell commands in Node.js. During tokenization, the function reduces intermediate tokens into a final array using Array.prototype.concat as the reducer. Each call to concat allocates a new array and copies all previously accumulated elements, yielding quadratic time complexity.

Because Node.js executes JavaScript on a single-threaded event loop, sustained CPU work inside parse() blocks all other request handling. A modest input of space-separated tokens forces enough copy operations to freeze the loop for seconds or longer. The issue is classified as [CWE-407: Inefficient Algorithmic Complexity].

Root Cause

The root cause is the use of Array.prototype.concat inside a reduce accumulator over a growing token list. The reducer should append in place or use a linear-cost flattening strategy. The chosen pattern produces O(n²) behavior where n is the number of input tokens.

Attack Vector

Exploitation requires only the ability to deliver an attacker-controlled string to a code path that calls parse(). The attack vector is network-based and requires no authentication, no user interaction, and no shell metacharacters. Web endpoints, message queues, log parsers, and CI pipelines that pass user input through shell-quote.parse() are all reachable surfaces. The result is event loop blockage and denial of service for all concurrent clients of the affected process.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-395f-4hp3-45gv for upstream technical details.

Detection Methods for CVE-2026-13311

Indicators of Compromise

Sustained 100% CPU utilization on a single Node.js worker thread without corresponding throughput.
Event loop lag metrics spiking into the seconds while inbound request rates remain low.
HTTP requests carrying unusually long space-separated token strings targeted at endpoints that invoke shell parsing.
Application timeouts and health-check failures clustered around requests reaching shell-quote.parse().

Detection Strategies

Inventory dependencies with npm ls shell-quote to identify direct and transitive use of versions below 1.8.5.
Instrument Node.js processes with perf_hooks event loop monitoring to surface prolonged blocking events.
Add Application Performance Monitoring (APM) traces around any function that calls parse() and alert on durations exceeding a baseline threshold.
Use Software Composition Analysis (SCA) tooling to flag shell-quote advisory GHSA-395f-4hp3-45gv across repositories.

Monitoring Recommendations

Monitor event loop lag, request latency percentiles, and per-process CPU time for Node.js services.
Alert on inbound payloads containing large numbers of whitespace-delimited tokens routed to known parser endpoints.
Correlate web application firewall (WAF) logs with backend latency spikes to identify single requests that degrade service performance.

How to Mitigate CVE-2026-13311

Immediate Actions Required

Upgrade shell-quote to version 1.8.5 or later across all direct and transitive dependencies.
Rebuild and redeploy Node.js applications and container images after the dependency upgrade.
Audit application code for any path that passes untrusted input to shell-quote.parse() and restrict input length.
Apply request-size and token-count limits at the reverse proxy or WAF layer for endpoints that perform shell parsing.

Patch Information

The issue is fixed in shell-quote version 1.8.5. The maintainers replaced the quadratic accumulator with a linear-cost finalization. Refer to the GitHub Security Advisory GHSA-395f-4hp3-45gv and the npm package page for release details.

Workarounds

Enforce a strict maximum length on any string passed to shell-quote.parse() before invocation.
Reject or truncate inputs that exceed a safe token count derived from latency testing.
Move parsing of untrusted input into a Node.js worker thread to prevent main event loop blockage.
Replace shell-quote.parse() calls on untrusted input with a custom whitelist-based tokenizer where feasible.

bash

# Configuration example: upgrade and verify shell-quote
npm install shell-quote@^1.8.5
npm ls shell-quote
npm audit --audit-level=high