CVE-2026-13311

Name of the Vulnerable Software and Affected Versions shell-quote versions prior to 1.8.5

Description The parse() function finalizes parsed tokens using Array.prototype.concat as a reduce accumulator, which causes the entire growing array to be reallocated and copied during every iteration. This results in quadratic time complexity relative to the number of input tokens. An attacker providing a controlled string to any code path that calls parse() can block the single-threaded Node.js event loop for an extended period, leading to a denial of service. This issue affects availability and does not allow for code execution or data disclosure.

Recommendations Update to version 1.8.5.