shell-quote vulnerabilities

1 known vulnerability in shell-quote from Ljharb. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  shell-quote: Inefficient Algorithmic Complexity

  CVE-2026-13311Jun 25, 2026Ljharb

  shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of inpu