CVE-2026-13311

Summary

shell-quote's parse() finalizes its token list with a reduce that uses Array.prototype.concat as the accumulator. Each prev.concat(arg) copies the entire growing array, so parse() runs in O(n²) in the number of tokens. An unauthenticated attacker who can submit a string to any code path that calls parse() on it can block the single-threaded Node.js event loop for tens of seconds with a small input — a denial of service. The trigger needs no shell metacharacters (plain space-separated words suffice), so input filters that only screen for ;, |, $, or backticks do not help.

Root cause

parse.js (lines 200–203), in parseInternal — this path runs on every parse() call:

}).reduce(function (prev, arg) { // finalize parsed arguments
    // TODO: replace this whole reduce with a concat
    return typeof arg === 'undefined' ? prev : prev.concat(arg);
}, []);

prev.concat(arg) allocates a new array and copies all of prev on every iteration, so producing an N-token result costs 1 + 2 + … + N = O(N²) copies. A second acc.concat(s) reduce in the module.exports wrapper (lines 211–224, reached only when env is a function) has the same shape. The maintainer's own // TODO: replace this whole reduce with a concat already flags the construct.

Proof of Concept

const { parse } = require('shell-quote');
const ms = fn => { const t = process.hrtime.bigint(); fn(); return Number(process.hrtime.bigint()-t)/1e6; };
for (const N of [16000, 32000, 64000, 128000]) {
  console.log(N, 'tokens ->', ms(() => parse('x '.repeat(N))).toFixed(0), 'ms');
}

Measured on [email protected], Node v24:

| input (N tokens) | bytes | parse() | ratio vs prev (2× input) | |-----------------:|-------:|----------:|:------------------------:| | 16 000 | 32 KB | 678 ms | — | | 32 000 | 64 KB | 4 169 ms | ×6.2 | | 64 000 | 128 KB | 14 914 ms | ×3.6 | | 128 000 | 256 KB | 57 319 ms | ×3.8 |

Time grows ~×4 per 2× input → confirmed O(n²). A ~128 KB input blocks the event loop ~15 s; ~256 KB → ~57 s; a few hundred KB more → minutes. <img width="656" height="214" alt="image" src="https://github.com/user-attachments/assets/e8955b0e-0527-45ca-94b7-c3a2d8c0c82e" /> poc.js

Impact

parse() is synchronous on the main thread; while it copies arrays quadratically the entire event loop is blocked and the process serves no other requests. Any service that calls parse() on attacker-influenced input (command parsers, chat-ops / bot command handlers, REPLs, build-script / arg-string splitters) can be driven to a sustained DoS with a single small request. No code execution and no data disclosure — availability only.

End-to-end confirmation: a minimal HTTP server that calls parse() on the request body, hit with one POST of 'x '.repeat(32000) (~63 KB), froze for ~4.5 s. An out-of-process probe client issuing harmless GET /ping requests (normally ~1 ms) observed 27 consecutive pings stalled by up to 4374 ms during that single request — i.e. every concurrent client was denied service for the whole parse. Scaling the body to a few hundred KB extends the outage to minutes.

This is the same class as several accepted 2026 advisories for quadratic-parser DoS on untrusted input (e.g. markdown-it CVE-2026-48988, js-yaml CVE-2026-53550, python-multipart CVE-2026-53539). It is distinct from the known shell-quote command-injection issues (CVE-2021-42740, CVE-2016-10541, CVE-2026-9277), which are all in quote(), not parse().

Suggested remediation

Replace the O(n²) concat-in-reduce with a linear flatten that pushes into the accumulator instead of reallocating and copying it on every iteration. Apply the same shape to the wrapper's acc.concat(s) reduce.…

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.

TuxCare rebuilt shell-quote to address 2 CVEs. Fixed in 1.7.3-tuxcare.1.

TuxCare rebuilt shell-quote to address 2 CVEs. Fixed in 1.8.1-tuxcare.2.

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.2.

TuxCare rebuilt shell-quote to address 2 CVEs. Fixed in 1.8.2-tuxcare.1.

These are all security issues fixed in the heroic-games-launcher-2.22.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-pytest-html-4.2.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-web-ui-23+75.1a877fb50-50.1 package on the GA media of openSUSE Tumbleweed.

This update for python-pytest-html fixes the following issues:

Changes in python-pytest-html:

• Revendor updating shell-quote and js-yaml deps:
  • CVE-2026-13311: shell-quote: inefficient input parsing can lead to a denial of service (bsc#1269361)
  • CVE-2026-53550: js-yaml: quadratic complexity when processing a crafted YAML document can lead to CPU exhaustion (bsc#1268818)

This update for agama-web-ui fixes the following issues:

• CVE-2025-7783: form-data: unsafe Math.random() function is used to select a boundary value for multipart form-encoded data (bsc#1246822).
• CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).
• CVE-2026-13149: brace-expansion: expand() function exhibits exponential-time complexity when processing non-expanding {} brace groups (bsc#1269927).
• CVE-2026-13311: shell-quote: quadratic complexity in parse() function when processing specially crafted strings (bsc#1269359).
• CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for HTTP-family URLs (bsc#1269595).
• CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in _.flatten and _.isEqual functions (bsc#1259169).
• CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs (bsc#1272311).
• CVE-2026-49356: @babel/core: arbitrary file read via sourceMappingURL comment (bsc#1272317).
• CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document (bsc#1268851).
• CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
• CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
• CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
• CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via router host+path substring matching (bsc#1272318).

Root has patched CVE-2026-13311 in the shell-quote package for Root:npm. Multiple fixed versions available.