Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T04:48:36 shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-1050

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.

A flaw was found in the `shell-quote` component. An attacker who can supply a specially crafted string to the `parse()` function can exploit an inefficiency in how the component processes input. This can cause the single-threaded Node.js event loop to be blocked for an extended period, leading to a denial of service (DoS) for the affected system. The vulnerability impacts the availability of the system, with no risk of code execution or data disclosure.

A flaw was found in the shell-quote npm package's `parse()` function, which uses an `O(n²)` array concatenation pattern when processing tokens. An attacker who can supply untrusted input to code paths calling `parse()` can block the Node.js event loop with a relatively small payload of space-separated words, causing a denial of service (DoS). The vulnerable `parse()` function is not typically exposed to external user input in Red Hat product deployments, reducing the practical exploitability of this flaw. Upgrade shell-quote to version 1.8.5. If upgrading shell-quote to version 1.8.5 or later is not immediately possible, the following mitigations can reduce exposure: 1. Validate and limit the length of any user-controlled strings before passing them to shell-quote's `parse()` function. 2. If `parse()` is not required, ensure that only the `quote()` function is used, as it is not affected by this vulnerability. Cryostat 4 Fix deferred cryostat-openshift-console-plugin-npm Cryostat 4 Fix deferred shell-quote Gatekeeper 3 Fix deferred gatekeeper/gatekeeper-rhel9 Migration Toolkit for Containers Fix deferred rhmtc/openshift-migration-ui-rhel8 Node HealthCheck Operator Fix deferred workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Fix deferred workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Fix deferred workload-availability/node-healthcheck-rhel9-operator OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-hub-ui-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-hub-ui-rhel9 OpenShift Service Mesh 2 Fix deferred openshift-service-mesh/kiali-ossmc-rhel8 OpenShift Service Mesh 2 Fix deferred openshift-service-mesh/kiali-rhel8 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-operator-bundle OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-rhel9-operator Red Hat AMQ Broker 7 Fix deferred shell-quote Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred automation-eda-controller Red Hat Ansible Automation Platform 2 Fix deferred automation-gateway Red Hat Ansible Automation Platform 2 Fix deferred automation-platform-ui Red Hat build of Apache Camel - HawtIO 4 Fix deferred shell-quote Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Data Grid 8 Fix deferred shell-quote Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 Fix deferred discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 10 Affected goose Red Hat Enterprise Linux 8 Not affected dotnet5.0-build-reference-packages Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Affected grafana-pcp Red Hat Enterprise Linux 8 Not affected pcs Red Hat Enterprise Linux 9 Affected goose Red Hat Enterprise Linux 9 Not affected pcs Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Will not fix rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 Fix deferred shell-quote Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-console-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 Fix deferred quay/quay-rhel8 Red Hat Trusted Artifact Signer Fix deferred rhtas/rekor-search-ui-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal https://www.cve.org/CVERecord?id=CVE-2026-13311 https://nvd.nist.gov/vuln/detail/CVE-2026-13311 https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv https://www.npmjs.com/package/shell-quote