Search
Find a vulnerability
Search criteria
2 vulnerabilities by cross-spawn
CVE-2024-21538 (GCVE-0-2024-21538)
Vulnerability from nvd – Published: 2024-11-08 05:00 – Updated: 2026-08-07 15:25
VLAI
EPSS
VEX
Summary
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 14:54 UTC
CWE
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | cross-spawn |
Affected:
0 , < 6.0.6
(semver)
Affected: 7.0.0 , < 7.0.5 (semver) |
|
| n/a | org.webjars.npm:cross-spawn |
Affected:
0 , < 6.0.6
(semver)
Affected: 7.0.2 , < 7.0.6 (semver) |
|
| cross-spawn | cross-spawn |
Affected:
0 , < 7.0.5
(custom)
cpe:2.3:a:cross-spawn:cross-spawn:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cross-spawn:cross-spawn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cross-spawn",
"vendor": "cross-spawn",
"versions": [
{
"lessThan": "7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21538",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T14:54:27.777922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-20T14:38:35.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cross-spawn",
"vendor": "n/a",
"versions": [
{
"lessThan": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.0.5",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
},
{
"product": "org.webjars.npm:cross-spawn",
"vendor": "n/a",
"versions": [
{
"lessThan": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.0.6",
"status": "affected",
"version": "7.0.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rongchen Li"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitCodeMaturity": "PROOF_OF_CONCEPT",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"version": "3.1"
},
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Regular Expression Denial of Service (ReDoS)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:25:37.876Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21538",
"datePublished": "2024-11-08T05:00:04.695Z",
"dateReserved": "2023-12-22T12:33:20.123Z",
"dateUpdated": "2026-08-07T15:25:37.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-21538 (GCVE-0-2024-21538)
Vulnerability from cvelistv5 – Published: 2024-11-08 05:00 – Updated: 2026-08-07 15:25
VLAI
EPSS
VEX
Summary
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 14:54 UTC
CWE
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | cross-spawn |
Affected:
0 , < 6.0.6
(semver)
Affected: 7.0.0 , < 7.0.5 (semver) |
|
| n/a | org.webjars.npm:cross-spawn |
Affected:
0 , < 6.0.6
(semver)
Affected: 7.0.2 , < 7.0.6 (semver) |
|
| cross-spawn | cross-spawn |
Affected:
0 , < 7.0.5
(custom)
cpe:2.3:a:cross-spawn:cross-spawn:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cross-spawn:cross-spawn:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cross-spawn",
"vendor": "cross-spawn",
"versions": [
{
"lessThan": "7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21538",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T14:54:27.777922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-20T14:38:35.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cross-spawn",
"vendor": "n/a",
"versions": [
{
"lessThan": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.0.5",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
},
{
"product": "org.webjars.npm:cross-spawn",
"vendor": "n/a",
"versions": [
{
"lessThan": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.0.6",
"status": "affected",
"version": "7.0.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rongchen Li"
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitCodeMaturity": "PROOF_OF_CONCEPT",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"version": "3.1"
},
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Regular Expression Denial of Service (ReDoS)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:25:37.876Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2024-21538",
"datePublished": "2024-11-08T05:00:04.695Z",
"dateReserved": "2023-12-22T12:33:20.123Z",
"dateUpdated": "2026-08-07T15:25:37.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}