Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-13311— shell-quote parse() is quadratic in token count, enabling denial of service

Quick assessment

Affected
ljharb shell-quote
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jordan Harband shell-quote是Jordan Harband个人开发者的一个命令行参数解析和引用处理的库。 Jordan Harband shell-quote 1.8.5之前版本存在资源管理错误漏洞，该漏洞源于在parse()中使用Array.prototype.concat作为reduce累加器完成解析令牌，导致每次迭代重新分配和复制整个增长的数组，使parse()运行时间复杂度为O(n^2)，攻击者通过提供攻击者控制的字符串调用parse()，可阻塞单线程Node.js事件循环

CVSS 7.5 · High EPSS 0.36% · P28

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
ljharb shell-quote ≤ 1.8.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13311

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
shell-quote parse() is quadratic in token count, enabling denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Vulnerability Title
Jordan Harband shell-quote 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jordan Harband shell-quote是Jordan Harband个人开发者的一个命令行参数解析和引用处理的库。 Jordan Harband shell-quote 1.8.5之前版本存在资源管理错误漏洞，该漏洞源于在parse()中使用Array.prototype.concat作为reduce累加器完成解析令牌，导致每次迭代重新分配和复制整个增长的数组，使parse()运行时间复杂度为O(n^2)，攻击者通过提供攻击者控制的字符串调用parse()，可阻塞单线程Node.js事件循环
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ljharb shell-quote 0 ~ 1.8.4 -

II. Public POCs for CVE-2026-13311

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9820 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-13311

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-13311 (1)

IV. Related Vulnerabilities

Same product: shell-quote
Same vendor: ljharb
Same weakness: CWE-407

V. Comments for CVE-2026-13311

No comments yet

Leave a comment