Executive brief
shell-quote is a widely-used Node.js library for parsing and quoting shell command arguments. The parse() function contains an algorithmic flaw that causes it to consume CPU quadratically with input size, allowing an attacker to freeze a server by sending a moderately-sized crafted input string. A ~128 KB payload can block the entire application for 15+ seconds, causing complete denial of service to all users.
Technical details
The vulnerability is an inefficient algorithmic complexity issue (CWE-407) in the parse() function's token finalization step. The code uses Array.prototype.concat() repeatedly in a reduce operation: prev.concat(arg) copies the entire growing accumulator array on each iteration, resulting in O(n²) time complexity for n tokens. An unauthenticated attacker can submit any string with repeated space-separated words (no shell metacharacters required) to trigger worst-case behavior. The proof-of-concept demonstrates that ~128 KB input (128,000 tokens) blocks the Node.js event loop for ~57 seconds, completely denying service to concurrent requests. The vulnerability affects all versions up to and including 1.8.4 and was patched in version 1.9.0 by replacing concat-in-reduce with linear-time array flattening using push operations.
Affected products
- ljharb shell-quote <= 1.8.4
Timeline
- 2026-06-25: disclosed
- 2026-06-25: patched: Fixed in version 1.9.0
- 2026-07-20: advisory