{"items":[{"id":"NVI-00016295","kind":"vulnerability","title":"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-395f-4hp3-45gv","CVE-2026-13311"],"plain_summary":"GitHub lists this reviewed advisory for shell-quote. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5eabd2059d316a67d91253fb7d8c9a02"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:49:34.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-647a7bd2a4713f575dde66d5e6a501a4"},{"kind":"CVSS","as_of":"2026-10-25T23:10:00.167Z","value":"7.5 HIGH (3.1)","meaning":"7ffcee3d-2c14-4c3e-b844-86c6a321a158 severity; no combined Null risk score.","source_id":"sr-5eabd2059d316a67d91253fb7d8c9a02"},{"kind":"CVSS","as_of":"2026-10-25T23:10:00.167Z","value":"8.7 HIGH (4.0)","meaning":"7ffcee3d-2c14-4c3e-b844-86c6a321a158 severity; no combined Null risk score.","source_id":"sr-5eabd2059d316a67d91253fb7d8c9a02"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-647a7bd2a4713f575dde66d5e6a501a4","url":"https://github.com/advisories/GHSA-395f-4hp3-45gv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-395f-4hp3-45gv","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:35:18.117Z"},{"id":"sr-5eabd2059d316a67d91253fb7d8c9a02","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13311","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-13311","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-07T13:57:03.791Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-647a7bd2a4713f575dde66d5e6a501a4"],"technology":"shell-quote","known_exclusions":[],"conditions_summary":"### Summary\n`shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses\n`Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing\narray, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who\ncan submit a string to any code path that calls `parse()` on it can block the single-threaded\nNode.js event loop for tens of seconds with a small input — a denial of service. The trigger\nneeds **no shell metacharacters** (plain space-separated words suffice), so input filters that\nonly screen for `;`, `|`, `$`, or backticks do not help.\n\n### Root cause\n`parse.js` (lines 200–203), in `parseInternal` — this path runs on **every** `parse()` call:\n\n```js\n}).reduce(function (prev, arg) { // finalize parsed arguments\n    // TODO: replace this whole reduce with a concat\n    return typeof arg === 'undefined' ? prev : prev.concat(arg);\n}, []);\n```\n\n`prev.concat(arg)` allocates a new array and copies all of `prev` on every iteration, so\nproducing an N-token result costs `1 + 2 + … + N = O(N²)` copies. A second `acc.concat(s)`\nreduce in the `module.exports` wrapper (lines 211–224, reached only when `env` is a function)","public_affected_ranges":["<= 1.8.4"]}],"null_published_at":"2026-11-07T18:43:12.114Z","source_updated_at":"2026-07-20T21:49:34.000Z","source_disclosed_at":"2026-07-20T21:49:34.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T22:35:18.117Z"},{"id":"NVI-00016295","kind":"vulnerability","title":"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-395f-4hp3-45gv","CVE-2026-13311"],"plain_summary":"GitHub lists this reviewed advisory for shell-quote. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-647a7bd2a4713f575dde66d5e6a501a4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:49:34.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-647a7bd2a4713f575dde66d5e6a501a4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-647a7bd2a4713f575dde66d5e6a501a4","url":"https://github.com/advisories/GHSA-395f-4hp3-45gv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-395f-4hp3-45gv","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:35:18.117Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-647a7bd2a4713f575dde66d5e6a501a4"],"technology":"shell-quote","known_exclusions":[],"conditions_summary":"### Summary\n`shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses\n`Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing\narray, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who\ncan submit a string to any code path that calls `parse()` on it can block the single-threaded\nNode.js event loop for tens of seconds with a small input — a denial of service. The trigger\nneeds **no shell metacharacters** (plain space-separated words suffice), so input filters that\nonly screen for `;`, `|`, `$`, or backticks do not help.\n\n### Root cause\n`parse.js` (lines 200–203), in `parseInternal` — this path runs on **every** `parse()` call:\n\n```js\n}).reduce(function (prev, arg) { // finalize parsed arguments\n    // TODO: replace this whole reduce with a concat\n    return typeof arg === 'undefined' ? prev : prev.concat(arg);\n}, []);\n```\n\n`prev.concat(arg)` allocates a new array and copies all of `prev` on every iteration, so\nproducing an N-token result costs `1 + 2 + … + N = O(N²)` copies. A second `acc.concat(s)`\nreduce in the `module.exports` wrapper (lines 211–224, reached only when `env` is a function)","public_affected_ranges":["<= 1.8.4"]}],"null_published_at":"2026-11-04T10:04:27.929Z","source_updated_at":"2026-07-20T21:49:34.000Z","source_disclosed_at":"2026-07-20T21:49:34.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:35:18.117Z"}],"next_cursor":null,"snapshot_revision":"42594"}