Shell Quote Project CVE debriefs

CVE-2026-13311

CVE-2026-13311 is a high-severity vulnerability in the shell-quote package, which can cause a denial of service (DoS) attack by blocking the Node.js event loop for an extended period. The vulnerability is caused by the inefficient use of Array.prototype.concat as a reduce accumulator in the parse() function, resulting in O(n^2) time complexity. An attacker can exploit this vulnerability by supplying a spe [truncated]