CVE-2024-21538
First published: Fri Nov 08 2024(Updated: )
Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
Credit: report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/cross-spawn | <6.0.6 | 6.0.6 |
| npm/cross-spawn | >=7.0.0<7.0.5 | 7.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff
- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f
- https://github.com/moxystudio/node-cross-spawn/pull/160
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349
- https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
- https://nvd.nist.gov/vuln/detail/CVE-2024-21538
- https://github.com/moxystudio/node-cross-spawn/issues/165
- https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd
- https://github.com/advisories/GHSA-3xgq-45jj-v275 (Advisory)
- https://www.ibm.com/support/pages/node/7182403 (Advisory)
- https://access.redhat.com/errata/RHSA-2024:10186
- https://access.redhat.com/errata/RHSA-2024:10665
- https://access.redhat.com/errata/RHSA-2024:10518
- https://access.redhat.com/errata/RHSA-2024:10908
- https://access.redhat.com/errata/RHSA-2024:10907
- https://access.redhat.com/errata/RHSA-2024:10823
- https://access.redhat.com/errata/RHSA-2024:10839
- https://access.redhat.com/errata/RHSA-2024:10986
- https://access.redhat.com/errata/RHSA-2024:11292
- https://access.redhat.com/errata/RHSA-2024:11031
- https://access.redhat.com/errata/RHSA-2025:0079
- https://access.redhat.com/errata/RHSA-2025:0082
- https://access.redhat.com/errata/RHSA-2025:0164
- https://access.redhat.com/errata/RHSA-2025:0892
- https://access.redhat.com/errata/RHSA-2025:0875
- https://bugzilla.redhat.com/show_bug.cgi?id=2324550
Frequently Asked Questions
What is the severity of CVE-2024-21538?
CVE-2024-21538 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How do I fix CVE-2024-21538?
To fix CVE-2024-21538, update the cross-spawn package to version 7.0.5 or later.
Which versions of cross-spawn are affected by CVE-2024-21538?
CVE-2024-21538 affects versions of the cross-spawn package prior to 7.0.5.
What can an attacker do with CVE-2024-21538?
An attacker can exploit CVE-2024-21538 to cause excessive CPU usage and potentially crash the application.
Is input sanitization relevant to CVE-2024-21538?
Yes, improper input sanitization is the root cause of the vulnerability in CVE-2024-21538.
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/author
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3xgq-45jj-v275
- alias/CVE-2024-21538
- agent/software-canonical-lookup
- collector/nvd-cve
- collector/github-advisory
- agent/severity
- agent/description
- agent/trending
- collector/mitre-cve
- source/MITRE
- collector/ibm-support
- source/IBM
- agent/references
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- package-manager/npm