A quadratic-time parsing flaw in shell-quote causes the parse() routine to use an inefficient reduce strategy that reallocates the entire token array on every iteration. When an attacker can supply any whitespace-separated string to a code path that calls parse(), the single-threaded Node.js event loop locks up, halting application responsiveness. The flaw is purely an availability issue with no code execution or data disclosure, and is classified as CWE-407.

The vulnerability affects the npm package shell-quote, specifically all versions earlier than 1.8.5 as maintained by the ljharb maintainer. Any project that imports a vulnerable version and passes user-controlled input to parse() is at risk.

The CVSS score of 8.7 indicates a high severity DoS risk. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that no widespread exploits have been documented. Attackers would need only to inject simple space-separated words into any call to parse(); the vector is inferred from the description and is likely via exposed application endpoints or libraries that process user data.