https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:41:07 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/cleanstart-2026-xs33213 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. shell-quote prior to 1.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. shell-quote prior to 1.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-xs33213 https://cve.radiocsirt.org/vuln/euvd-2026-330153 EUVD-2026-330153 https://cve.radiocsirt.org/vuln/euvd-2026-330153 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13311 <p>shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.</p> <p>shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13311 https://cve.radiocsirt.org/vuln/ghsa-395f-4hp3-45gv <p><strong>Affected:</strong> npm: shell-quote</p> <p>### Summary `shell-quote`&#39;s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing array, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who can submit a string to any code path that calls `parse()` on it can block the single-threaded Node.js event loop for tens of seconds with a small input — a denial of service. The trigger needs **no shell metacharacters** (plain space-separated words suffice), so input filters that only screen for `;`, `|`, `$`, or backticks do not help.</p> <p>### Root cause `parse.js` (lines 200–203), in `parseInternal` — this path runs on **every** `parse()` call:</p> <p>```js }).reduce(function (prev, arg) { // finalize parsed arguments // TODO: replace this whole reduce with a concat return typeof arg === &#39;undefined&#39; ? prev : prev.concat(arg); }, []); ```</p> <p>`prev.concat(arg)` allocates a new array and copies all of `prev` on every iteration, so producing an N-token result costs `1 + 2 + … + N = O(N²)` copies. A second `acc.concat(s)` reduce in the `module.exports` wrapper (lines 211–224, reached only when `env` is a function) has the same shape. The maintainer&#39;s own `// TODO: replace this whole reduce with a concat` already flags the construct.</p> <p>### Proof of Concept ```js const { parse } = require(&#39;shell-quote&#39;); const ms = fn =&gt; { const t = process.hrtime.bigint(); fn(); return Number(process.hrtime.bigint()-t)/1e6; }…</p> <p><strong>Affected:</strong> npm: shell-quote</p> <p>### Summary `shell-quote`&#39;s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing array, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who can submit a string to any code path that calls `parse()` on it can block the single-threaded Node.js event loop for tens of seconds with a small input — a denial of service. The trigger needs **no shell metacharacters** (plain space-separated words suffice), so input filters that only screen for `;`, `|`, `$`, or backticks do not help.</p> <p>### Root cause `parse.js` (lines 200–203), in `parseInternal` — this path runs on **every** `parse()` call:</p> <p>```js }).reduce(function (prev, arg) { // finalize parsed arguments // TODO: replace this whole reduce with a concat return typeof arg === &#39;undefined&#39; ? prev : prev.concat(arg); }, []); ```</p> <p>`prev.concat(arg)` allocates a new array and copies all of `prev` on every iteration, so producing an N-token result costs `1 + 2 + … + N = O(N²)` copies. A second `acc.concat(s)` reduce in the `module.exports` wrapper (lines 211–224, reached only when `env` is a function) has the same shape. The maintainer&#39;s own `// TODO: replace this whole reduce with a concat` already flags the construct.</p> <p>### Proof of Concept ```js const { parse } = require(&#39;shell-quote&#39;); const ms = fn =&gt; { const t = process.hrtime.bigint(); fn(); return Number(process.hrtime.bigint()-t)/1e6; }…</p> https://cve.radiocsirt.org/vuln/ghsa-395f-4hp3-45gv https://cve.radiocsirt.org/vuln/opensuse-su-2026:11145-1 <p>heroic-games-launcher-2.22.0-3.1 on GA media</p> <p>heroic-games-launcher-2.22.0-3.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11145-1 https://cve.radiocsirt.org/vuln/rhsa-2026:60520 <p>urllib3: urllib3 Streaming API improperly handles highly compressed data github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links image-size: image-size: Denial of Service via crafted image buffer with zero-valued size field image-size: image-size: Denial of Service via crafted ICNS image buffer mlflow/mlflow: mlflow/mlflow: Unauthenticated remote code execution via unprotected job endpoints mlflow: mlflow: Arbitrary file read via bypassed source path validation python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy form-data: form-data: Form field override via CRLF injection undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames nltk: NLTK: Information disclosure via path traversal vulnerability keras: Keras: Arbitrary code execution via deserialization vulnerability brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity shell-quo…</p> <p>urllib3: urllib3 Streaming API improperly handles highly compressed data github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links image-size: image-size: Denial of Service via crafted image buffer with zero-valued size field image-size: image-size: Denial of Service via crafted ICNS image buffer mlflow/mlflow: mlflow/mlflow: Unauthenticated remote code execution via unprotected job endpoints mlflow: mlflow: Arbitrary file read via bypassed source path validation python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability fast-uri: fast-uri: URI authority bypass due to improper delimiter handling undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy form-data: form-data: Form field override via CRLF injection undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames nltk: NLTK: Information disclosure via path traversal vulnerability keras: Keras: Arbitrary code execution via deserialization vulnerability brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity shell-quo…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:60520 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13311 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-shell-quote, Ubuntu:Pro:22.04:LTS: node-shell-quote, Ubuntu:24.04:LTS: node-shell-quote, Ubuntu:25.10: node-shell-quote, Ubuntu:Pro:26.04:LTS: node-shell-quote</p> <p>shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-shell-quote, Ubuntu:Pro:22.04:LTS: node-shell-quote, Ubuntu:24.04:LTS: node-shell-quote, Ubuntu:25.10: node-shell-quote, Ubuntu:Pro:26.04:LTS: node-shell-quote</p> <p>shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13311