CVE-2026-13311: shell-quote Package Suffers from Quadratic-complexity Denial of Service Vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The shell-quote package is a Node.js library that provides functionality for parsing and quoting shell command strings. It is commonly used in applications that require command-line interaction or command parsing. The package is designed to handle various shell metacharacters and arguments, making it a versatile tool for developers. However, it has a vulnerability that can lead to significant performance issues under certain conditions, specifically when processing large input strings.

Vulnerability Detail

The vulnerability in the shell-quote package arises from the parse() function, which uses a quadratic-complexity algorithm due to the way it concatenates arrays. Each call to prev.concat(arg) creates a new array and copies the entire previous array, leading to O(n²) time complexity. This means that as the number of tokens increases, the time taken to process them grows exponentially. An unauthenticated attacker can exploit this by submitting specially crafted input, causing the Node.js event loop to block for extended periods, resulting in a denial of service. This vulnerability does not require shell metacharacters, making it particularly insidious as traditional input filters may not catch it.

npm install shell-quote@1.12.0

npm install shell-quote@1.9.0

Workaround

As a temporary workaround, you can implement an input length cap on the parse() function to prevent excessively large inputs from being processed. This can be done by checking the length of the input string before calling parse(), as shown in the following code snippet:

const { parse } = require('shell-quote');
const MAX_INPUT_LENGTH = 10000; // Set a maximum input length

function safeParse(input) {
  if (input.length > MAX_INPUT_LENGTH) {
    throw new Error('Input exceeds maximum allowed length.');
  }
  return parse(input);
}

Conclusion

The shell-quote package has a significant vulnerability that can lead to denial of service due to its quadratic complexity in the parse() function. It is crucial for developers using this package to update to the patched version to mitigate the risk. Additionally, implementing input length checks can serve as a temporary workaround while transitioning to the fixed version.

See every vulnerability recorded for shell-quote →

FAQ