---
title: "cross-spawn security advisories"
description: "1 known security advisory for cross-spawn, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/cross-spawn/security
lang: en
---

[Packages](https://inlinr.com/packages)

# cross-spawn

7.0.6 · 18 Nov 2024 MIT 345.6M / week [Repository](https://github.com/moxystudio/node-cross-spawn) [npm](https://www.npmjs.com/package/cross-spawn) [Atom feed](https://inlinr.com/packages/feed/cross-spawn)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                           |
| ---- | ------ | ------------------------------------------------------------------------- |
|      | 7.0.6  | Safe from 7.0.5                                                           |
|      | 6.0.6  | 9 open advisories, worst high  · last release Nov 2024, no longer updated |

- High  
[Regular Expression Denial of Service (ReDoS) in cross-spawn](https://inlinr.com/advisories/GHSA-3xgq-45jj-v275)GHSA-3xgq-45jj-v275 · 8 Nov 2024  
fixed in 7.0.5, 6.0.6

### Quality and security signals

What [npm](https://www.npmjs.com/package/cross-spawn) and [deps.dev](https://deps.dev/npm/cross-spawn) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Reading releases, release notes and advisories…

Registry facts last checked 3 Nov 2026\. Releases and advisories last read 3 Nov 2026.