CVE-2026-13311

A flaw was found in the shell-quote component. An attacker who can supply a specially crafted string to the parse() function can exploit an inefficiency in how the component processes input. This can cause the single-threaded Node.js event loop to be blocked for an extended period, leading to a denial of service (DoS) for the affected system. The vulnerability impacts the availability of the system, with no risk of code execution or data disclosure.

A flaw was found in the shell-quote npm package's parse() function, which uses an O(n²) array concatenation pattern when processing tokens. An attacker who can supply untrusted input to code paths calling parse() can block the Node.js event loop with a relatively small payload of space-separated words, causing a denial of service (DoS). The vulnerable parse() function is not typically exposed to external user input in Red Hat product deployments, reducing the practical exploitability of this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade shell-quote to version 1.8.5.

If upgrading shell-quote to version 1.8.5 or later is not immediately possible, the following mitigations can reduce exposure:

1. Validate and limit the length of any user-controlled strings before passing them to shell-quote's parse() function.
2. If parse() is not required, ensure that only the quote() function is used, as it is not affected by this vulnerability.