CLEANSTART-2026-QX32529: Versions of the package cross-spawn before 6

Q: Which deployments are exposed?

Deployments of cleanstart/argo-workflows that include cross-spawn versions earlier than 6 are affected. The provided data does not identify a narrower configuration requirement.

Q: Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected security impact?

The provided vector indicates an availability impact only; confidentiality and integrity impacts are listed as none. The severity is high, with a CVSS score of 7.7.

Q: What version should be used to remediate this issue?

Update the cross-spawn dependency to version 6 or later. The affected range is specified as versions before 6.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Versions of the package cross-spawn before 6.

Affected Software

2 affected componentsFixes available

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1
Upgrade
Upgrade cross-spawn to a version that resolves this vulnerability.
Fixed in 6

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-21538

Frequently Asked Questions

Which deployments are exposed?

Deployments of cleanstart/argo-workflows that include cross-spawn versions earlier than 6 are affected. The provided data does not identify a narrower configuration requirement.

Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected security impact?

The provided vector indicates an availability impact only; confidentiality and integrity impacts are listed as none. The severity is high, with a CVSS score of 7.7.

What version should be used to remediate this issue?

Update the cross-spawn dependency to version 6 or later. The affected range is specified as versions before 6.

CLEANSTART-2026-QX32529: Versions of the package cross-spawn before 6

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What is the expected security impact?

What version should be used to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What is the expected security impact?

What version should be used to remediate this issue?