{"action":"Upgrade shell-quote to 1.9.0 or later.","affected":[{"fixed":"1.9.0","introduced":"0"}],"component":"shell-quote","cve_ids":["CVE-2026-13311"],"ecosystem":"npm","epss":0.0036,"exploited":false,"fixed_versions":["1.9.0"],"ghsa_id":"GHSA-395f-4hp3-45gv","id":"tcs_01M5KEWRR3G0R1DW0Z9MMTH51R","modified_at":"2026-09-10T03:51:10.090834688Z","published_at":"2026-07-20T21:49:34Z","references":["https://osv.dev/vulnerability/GHSA-395f-4hp3-45gv","https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv","https://nvd.nist.gov/vuln/detail/CVE-2026-13311","https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec","https://github.com/ljharb/shell-quote","https://github.com/ljharb/shell-quote/releases/tag/v1.9.0","https://www.npmjs.com/package/shell-quote"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-395f-4hp3-45gv","url":"https://osv.dev/vulnerability/GHSA-395f-4hp3-45gv"}],"summary":"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)"}