StackRadar

CVE-2026-13311

High

Advisory

Published 20 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
86
of 17,781 indexed, latest versions
Container images
83
deployed by those charts
Fix available
1 of 1
affected package

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Carried by container images the latest versions of 86 of 17,781 indexed charts deploy, on 83 images.

Affected packageAffected versionsFixed inImages
shell-quotenpm1.4.3, 1.6.1, 1.7.2, 1.7.3+6 more1.9.083
OSV records
GHSA-395f-4hp3-45gv

Charts affected

86 by stars
ChartLatestAffected imagesRadar Score
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
shell-quote@1.8.3
1.9.0

Open the chart page →

3,555
squareonelsst-sqre0.4.11 of 1See more

squareone lsst-sqre 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
lsstsqre/squareone:0.4.09ded78e7fe03
shell-quote@1.7.2
1.9.0

Open the chart page →

2,247
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
shell-quote@1.7.2
1.9.0

Open the chart page →

3,651
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
shell-quote@1.7.2
1.9.0

Open the chart page →

11,695
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
shell-quote@1.7.2
1.9.0

Open the chart page →

11,695
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
shell-quote@1.7.2
1.9.0

Open the chart page →

12,108
mojaloopmojaloop14.0.02 of 6See more

mojaloop mojaloop 14.0.0

2 of the 6 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
shell-quote@1.7.2
1.9.0
mojaloop/central-ledger:v13.14.01abc8a7aa71c
shell-quote@1.7.2
1.9.0

Open the chart page →

19,226
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
shell-quote@1.7.2
1.9.0

Open the chart page →

6,438
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
shell-quote@1.8.1
1.9.0

Open the chart page →

4,560
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
shell-quote@1.8.3
1.9.0

Open the chart page →

4,016
myawesomeappmyawesomapp-mitchxxx0.1.11 of 1See more

myawesomeapp myawesomapp-mitchxxx 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
mitchxxx/amazon:214e72480ec63a
shell-quote@1.8.1
1.9.0

Open the chart page →

2,116
myawesomeapp14myawesomeapp140.1.11 of 1See more

myawesomeapp14 myawesomeapp14 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
ccjacobs14/amazon:59a9b14a6f09e
shell-quote@1.8.1
1.9.0

Open the chart page →

2,116
myawesomeapp-janmyawesomeapp-jan0.1.11 of 1See more

myawesomeapp-jan myawesomeapp-jan 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
ooghenekaro/amazon:latest03394ba1d6d8
shell-quote@1.8.1
1.9.0

Open the chart page →

2,144
myawesomeapp-marmyawesomeapp-mar0.1.11 of 1See more

myawesomeapp-mar myawesomeapp-mar 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
winfred008/amazon:910a68de5b398
shell-quote@1.8.1
1.9.0

Open the chart page →

2,116
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
shell-quote@1.8.0
1.9.0

Open the chart page →

17,929
dashynas-helm-chartsVerified publisher1.0.41 of 1See more

dashy nas-helm-charts 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
lissy93/dashy:2.0.51991f7be5ed0
shell-quote@1.7.3
1.9.0

Open the chart page →

3,269
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
shell-quote@1.8.3
1.9.0

Open the chart page →

3,798
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
shell-quote@1.8.1
1.9.0

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
shell-quote@1.8.1
1.9.0

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
shell-quote@1.8.0
1.9.0

Open the chart page →

15,187
example-idpory0.64.01 of 1See more

example-idp ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
oryd/hydra-login-consent-node:v26.2.06465e95993b5
shell-quote@1.7.3
1.9.0

Open the chart page →

838
kratos-selfservice-ui-noderadar-baseVerified publisher0.43.11 of 1See more

kratos-selfservice-ui-node radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
shell-quote@1.8.1
1.9.0

Open the chart page →

2,969
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
shell-quote@1.4.3
1.9.0

Open the chart page →

5,215
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
shell-quote@1.8.3
1.9.0

Open the chart page →

5,338
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
shell-quote@1.7.3
1.9.0

Open the chart page →

7,413
semaphoreschoenwald0.1.31 of 1See more

semaphore schoenwald 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
0hlov3/semaphore:v1.0.050f874ec096b
shell-quote@1.7.4
1.9.0

Open the chart page →

1,796
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
shell-quote@1.8.1
1.9.0

Open the chart page →

5,497
dashysergiotocaliniVerified publisher1.0.01 of 1See more

dashy sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
shell-quote@1.7.3
1.9.0

Open the chart page →

3,143
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
shell-quote@1.7.2
1.9.0

Open the chart page →

3,696
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
shell-quote@1.8.1
1.9.0

Open the chart page →

7,574
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
shell-quote@1.6.1
1.9.0

Open the chart page →

3,881
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
shell-quote@1.6.1
1.9.0

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
shell-quote@1.6.1
1.9.0

Open the chart page →

12,460
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
shell-quote@1.7.2
1.9.0

Open the chart page →

20,270
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
shell-quote@1.8.2
1.9.0

Open the chart page →

5,228
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-13311.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
shell-quote@1.7.4
1.9.0
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
shell-quote@1.7.4
1.9.0

Open the chart page →

16,083

Container images carrying it

83 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
shell-quote@1.7.4
1.9.0
1
thmmniii/fbs-qcm-frontend:v1.27.1a347f7f4d144
shell-quote@1.8.1
1.9.0
1
treskon/portrait-ui:DEV-lateste7970783bc8d
shell-quote@1.8.4
1.9.0
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
shell-quote@1.8.1
1.9.0
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
shell-quote@1.7.3
1.9.0
1
vlebediantsev/notes-admin-front:latest007c6670ff48
shell-quote@1.8.1
1.9.0
1
vlebediantsev/notes-project-front:latest945675fd2636
shell-quote@1.8.1
1.9.0
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
shell-quote@1.8.0
1.9.0
1
winfred008/amazon:910a68de5b398
shell-quote@1.8.1
1.9.0
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
shell-quote@1.7.2
1.9.0
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
shell-quote@1.8.3
1.9.0
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
shell-quote@1.8.1
1.9.0
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
shell-quote@1.8.1
1.9.0
1
ghcr.io/data-fair/metrics:0a8d40779eeae
shell-quote@1.7.3
1.9.0
1
ghcr.io/data-fair/notify:3c739b74dabb0
shell-quote@1.8.2
1.9.0
1
ghcr.io/data-fair/processings:15a9216989707
shell-quote@1.8.1
1.9.0
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
shell-quote@1.7.3
1.9.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
shell-quote@1.8.2
1.9.0
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
shell-quote@1.8.1
1.9.0
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
shell-quote@1.8.3
1.9.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
shell-quote@1.8.3
1.9.0
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
shell-quote@1.8.3
1.9.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
shell-quote@1.8.2
1.9.0
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
shell-quote@1.7.2
1.9.0
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
shell-quote@1.8.1
1.9.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
shell-quote@1.8.3
1.9.0
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
shell-quote@1.8.3
1.9.0
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
shell-quote@1.7.4
1.9.0
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
shell-quote@1.8.3
1.9.0
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
shell-quote@1.8.3
1.9.0
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
shell-quote@1.6.1
1.9.0
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
shell-quote@1.7.2
1.9.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
shell-quote@1.8.3
1.9.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.