CVE catalog

CVE-2026-13311

Severity: High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Jun 25, 2026, 4:48:36 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 25, 2026

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-shell-quote	sid	`1.12.0-1`	fixed
Debian	node-shell-quote	forky	`1.12.0-1`	fixed
Debian	node-shell-quote	trixie	`1.7.4+~1.7.1-1+deb13u1`	vulnerable
Debian	node-shell-quote	trixie-security	`1.7.4+~1.7.1-1+deb13u2`	fixed
Debian	node-shell-quote	bookworm	`1.7.4+~1.7.1-1+deb12u1`	vulnerable
Debian	node-shell-quote	bookworm-security	`1.7.4+~1.7.1-1+deb12u1`	vulnerable
Cpe	node-shell-quote	Not reported	Not reported	vulnerable
Cpe	shell-quote	Not reported	`1.9.0`	fixed
Npm	shell-quote	Not reported	`1.9.0`	fixed
Opensuse	agama-web-ui	tumbleweed	`23+75.1a877fb50-50.1`	fixed
Opensuse	python-pytest-html	leap 16.0	`4.1.1-bp160.3.1`	fixed
Opensuse	python-pytest-html	tumbleweed	`4.2.0-3.1`	fixed
Opensuse	heroic-games-launcher	tumbleweed	`2.22.0-3.1`	fixed
Cpe	shell-quote	Not reported	`1.9.0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-shell-quote	source	sid	`1.9.0+~1.7.5-1`	not yet assigned	Not reported	[1140921]
Debian	node-shell-quote	source	forky	`1.9.0+~1.7.5-1`	not yet assigned	Not reported	[1140921]
Debian	node-shell-quote	source	trixie	`1.7.4+~1.7.1-1+deb13u2`	not yet assigned	Not reported	[1140921]
Debian	node-shell-quote	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1140921]
Cpe	shell-quote	cpe	Not reported	`1.9.0`	Not reported	Not reported	Not reported
Npm	shell-quote	npm	Not reported	`1.9.0`	Not reported	Not reported	Not reported
Opensuse	agama-web-ui	rpm	tumbleweed	`23+75.1a877fb50-50.1`	Not reported	OPENSUSE-SU-2026:11472-1	Not reported
Opensuse	python-pytest-html	rpm	leap 16.0	`4.1.1-bp160.3.1`	Not reported	OPENSUSE-SU-2026:21176-1	Not reported
Opensuse	python-pytest-html	rpm	tumbleweed	`4.2.0-3.1`	Not reported	OPENSUSE-SU-2026:11149-1	Not reported
Opensuse	heroic-games-launcher	rpm	tumbleweed	`2.22.0-3.1`	Not reported	OPENSUSE-SU-2026:11145-1	Not reported
Cpe	shell-quote	cpe	Not reported	`1.9.0`	Not reported	NVD-CVE-2026-13311	Not reported

[Debian bug #1140921]

Notes

[bookworm] node-shell-quote: Minor issue; quadratic-complexity DoS in parse(), reachable only where a service parses attacker-supplied strings

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[node-shell-quote]Affected
Details (4)
- 1.7.4+~1.7.1-1+deb12u1 · all · bookworm
  Affected
  nvd · node-shell-quote · debian · bookworm; nvd · node-shell-quote · debian · 12
- 1.7.4+~1.7.1-1+deb12u1 · all · bookworm
  Affected
  nvd · node-shell-quote · debian · bookworm; nvd · node-shell-quote · debian · 12
- 1.7.4+~1.7.1-1+deb12u1 · all · bookworm-security
  Affected
  nvd · node-shell-quote · debian · bookworm; nvd · node-shell-quote · debian · 12
- 1.7.4+~1.7.1-1+deb12u1 · all · bookworm-security
  Affected
  nvd · node-shell-quote · debian · bookworm; nvd · node-shell-quote · debian · 12

[Debian 13 (Trixie)]

[node-shell-quote]Affected
Details (5)
- 1.7.4+~1.7.1-1+deb13u1 · all · trixie
  Affected · Fixed: 1.7.4+~1.7.1-1+deb13u2
  nvd · node-shell-quote · debian · 13
- 1.7.4+~1.7.1-1+deb13u1 · all · trixie
  Affected · Fixed: 1.7.4+~1.7.1-1+deb13u2
  nvd · node-shell-quote · debian · 13
- 1.7.4+~1.7.1-1+deb13u1 · all · trixie-security
  Affected · Fixed: 1.7.4+~1.7.1-1+deb13u2
  nvd · node-shell-quote · debian · 13
- 1.7.4+~1.7.1-1+deb13u1 · all · trixie-security · Historical version
  Affected · Fixed: 1.7.4+~1.7.1-1+deb13u2
  nvd · node-shell-quote · debian · 13
- 1.7.4+~1.7.1-1+deb13u2 · all · trixie-security
  Fixed · Fixed: 1.7.4+~1.7.1-1+deb13u2
  nvd · node-shell-quote · debian · 13

[openSUSE Tumbleweed]

[python313-pytest-html]Unknown
Source package: [python-pytest-html]
Details (1)
- 4.2.0-5.1 · noarch · tumbleweed
  Unknown · Fixed: 4.2.0-3.1
  Version impact unknown
  nvd · python-pytest-html · opensuse · tumbleweed
[python314-pytest-html]Unknown
Source package: [python-pytest-html]
Details (1)
- 4.2.0-5.1 · noarch · tumbleweed
  Unknown · Fixed: 4.2.0-3.1
  Version impact unknown
  nvd · python-pytest-html · opensuse · tumbleweed
[agama-web-ui]Fixed
Source package: [agama-web-ui]
Details (1)
- 23+278.4096bc82f-51.1 · noarch · tumbleweed
  Fixed · Fixed: 23+75.1a877fb50-50.1
  nvd · agama-web-ui · opensuse · tumbleweed
[heroic-games-launcher]Fixed
Source package: [heroic-games-launcher]
Details (1)
- 2.22.1-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 2.22.0-3.1
  nvd · heroic-games-launcher · opensuse · tumbleweed

Observed: Oct 27, 2026, 7:13:58 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]