---
title: "GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn"
description: "High severity. Regular Expression Denial of Service (ReDoS) in cross-spawn. Affects cross-spawn; fixed in 7.0.5."
url: https://inlinr.com/advisories/GHSA-3xgq-45jj-v275
lang: en
---

[Packages](https://inlinr.com/packages) / [cross-spawn](https://inlinr.com/packages/cross-spawn) / [Security](https://inlinr.com/packages/cross-spawn/security)

High Vulnerability GHSA-3xgq-45jj-v275 CVE-2024-21538 Published 8 Nov 2024

# Regular Expression Denial of Service (ReDoS) in cross-spawn

Your version 

Affected releases · [cross-spawn](https://inlinr.com/packages/cross-spawn)

- 7.x 7.0.0 – 7.0.4 Fixed in 7.0.5
- 6.x 6.0.0 – 6.0.5 Fixed in 6.0.6
- 5.x and older 0.1.0 – 5.1.0 No fix, no longer updated

On 7.x, the newest line:

```
npm install cross-spawn@7.0.5
```

Every release on a timeline

7.x 

1. Affected

7.0.0 – 7.0.4  
5 releases
2. Fixed

7.0.5 – 7.0.6  
2 releases, latest

6.x 

1. Affected

6.0.0 – 6.0.5  
6 releases
2. Fixed

6.0.6  
1 release

5.x 

1. Affected

5.0.0 – 5.1.0  
3 releases

4.x 

1. Affected

4.0.0 – 4.0.2  
2 releases

3.x 

1. Affected

3.0.0 – 3.0.1  
2 releases

2.x 

1. Affected

2.0.0 – 2.2.3  
11 releases

1.x 

1. Affected

1.0.0 – 1.0.4  
5 releases

0.x 

1. Affected

0.1.0 – 0.4.1  
21 releases

58 stable releases of cross-spawn, oldest to newest, one row per major.

## What happens

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-21538 "https://nvd.nist.gov/vuln/detail/CVE-2024-21538")  
nvd.nist.gov/vuln/detail/CVE-2024-21538
- [Issue](https://github.com/moxystudio/node-cross-spawn/issues/165 "https://github.com/moxystudio/node-cross-spawn/issues/165")  
#165
- [Pull request](https://github.com/moxystudio/node-cross-spawn/pull/160 "https://github.com/moxystudio/node-cross-spawn/pull/160")  
#160
- [Fix commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff")  
5ff3a07
- [Fix commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f")  
640d391
- [Fix commit](https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd "https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd")  
d35c865
- [Package](https://github.com/moxystudio/node-cross-spawn "https://github.com/moxystudio/node-cross-spawn")  
github.com/moxystudio/node-cross-spawn
- [Reference](https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349 "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349")  
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8…
- [Reference](https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230")  
security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230