CVE-2024-21538

Published: Nov 8, 2024Modified: Jun 17, 2026Deferred

7.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: report@snyk.io (Secondary)

Description

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Related CWEs

CWE-1333

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (5)

https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff

Source: report@snyk.io

https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f

Source: report@snyk.io

https://github.com/moxystudio/node-cross-spawn/pull/160

Source: report@snyk.io

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349

Source: report@snyk.io

https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230

Source: report@snyk.io

Timeline

No history available yet.