Packages / cross-spawn / Security

HighVulnerabilityGHSA-3xgq-45jj-v275CVE-2024-21538Published 8 Nov 2024

Regular Expression Denial of Service (ReDoS) in cross-spawn

Your version

Affected releases · cross-spawn

  • 7.x7.0.0 – 7.0.4Fixed in 7.0.5
  • 6.x6.0.0 – 6.0.5Fixed in 6.0.6
  • 5.x and older0.1.0 – 5.1.0No fix, no longer updated

On 7.x, the newest line:

npm install cross-spawn@7.0.5
Every release on a timeline
7.x

  1. Affected

    7.0.0 – 7.0.4

    5 releases

  2. Fixed

    7.0.5 – 7.0.6

    2 releases, latest

6.x

  1. Affected

    6.0.0 – 6.0.5

    6 releases

  2. Fixed

    6.0.6

    1 release

5.x

  1. Affected

    5.0.0 – 5.1.0

    3 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    2 releases

3.x

  1. Affected

    3.0.0 – 3.0.1

    2 releases

2.x

  1. Affected

    2.0.0 – 2.2.3

    11 releases

1.x

  1. Affected

    1.0.0 – 1.0.4

    5 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    21 releases

58 stable releases of cross-spawn, oldest to newest, one row per major.

What happens

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.