# CVE-2026-13311: ljharb shell-quote Denial of Service in parse function

Source: https://junglewise.ai/threats/cve-2026-13311-ljharb-shell-quote-denial-of-service-in-parse-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13311 · Severity: high · CVSS 7.5 · Published 2026-06-25

shell-quote is a widely-used Node.js library for parsing and quoting shell command arguments. The parse() function contains an algorithmic flaw that causes it to consume CPU quadratically with input size, allowing an attacker to freeze a server by sending a moderately-sized crafted input string. A ~128 KB payload can block the entire application for 15+ seconds, causing complete denial of service to all users.

Technologies: [shell-quote (npm)](https://junglewise.ai/threats/technologies/shell-quote). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-13311 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13311 being exploited in the wild.

**How severe is CVE-2026-13311?** High severity, with a CVSS score of 7.5, published 25 June 2026.

**Which products and versions are affected?** shell-quote (npm) <= 1.8.4, SEMVER:introduced=0,fixed=1.9.0.

**Is there a fix for CVE-2026-13311?** Yes. shell-quote (npm): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13311 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13311?** Check whether you run shell-quote (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shell-quote (npm): upgrade to 1.9.0 or later

  ```sh
  npm install shell-quote@1.9.0
  ```


## Technical details

The vulnerability is an inefficient algorithmic complexity issue (CWE-407) in the parse() function's token finalization step. The code uses Array.prototype.concat() repeatedly in a reduce operation: prev.concat(arg) copies the entire growing accumulator array on each iteration, resulting in O(n²) time complexity for n tokens. An unauthenticated attacker can submit any string with repeated space-separated words (no shell metacharacters required) to trigger worst-case behavior. The proof-of-concept demonstrates that ~128 KB input (128,000 tokens) blocks the Node.js event loop for ~57 seconds, completely denying service to concurrent requests. The vulnerability affects all versions up to and including 1.8.4 and was patched in version 1.9.0 by replacing concat-in-reduce with linear-time array flattening using push operations.

## Affected products

- ljharb shell-quote <= 1.8.4

## Identifiers

- CVE-2026-13311
- GHSA-395f-4hp3-45gv

## Timeline

- 2026-06-25: disclosed
- 2026-06-25: patched: Fixed in version 1.9.0
- 2026-07-20: advisory

## References

- [https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv](https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv)
- [https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec](https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec)
- [https://github.com/ljharb/shell-quote](https://github.com/ljharb/shell-quote)
- [https://github.com/ljharb/shell-quote/releases/tag/v1.9.0](https://github.com/ljharb/shell-quote/releases/tag/v1.9.0)
- [https://www.npmjs.com/package/shell-quote](https://www.npmjs.com/package/shell-quote)

## Related threats

- [shell-quote quote() function code injection in comment handling](https://junglewise.ai/threats/cve-2026-102422-shell-quote-s-quote-function-emits-a-comment-token-as-followed)
- [ljharb shell-quote command injection in quote function](https://junglewise.ai/threats/cve-2026-9277-ljharb-shell-quote-command-injection-in-quote-function)
- [shell-quote command injection via Windows drive letter regex](https://junglewise.ai/threats/cve-2021-42740-shell-quote-command-injection-via-windows-drive-letter-regex)
- [shell-quote command injection in argument escaping](https://junglewise.ai/threats/cve-2016-10541-shell-quote-command-injection-in-argument-escaping)