PT-2023-9813 · Unknown+2 · Cross-Spawn+2
Rongchen Li
·
Published
2023-12-22
·
Updated
2026-06-04
·
CVE-2024-21538
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
cross-spawn versions prior to 7.0.5
Description
The issue is related to a Regular Expression Denial of Service (ReDoS) in the cross-spawn package. This occurs due to improper input sanitization, allowing an attacker to craft a large and well-crafted string that can increase CPU usage and crash the program. The exploitation of this issue can lead to a denial of service.
Recommendations
For versions prior to 7.0.5, update to version 7.0.5 or later to resolve the issue. As a temporary workaround, consider restricting input to prevent large and maliciously crafted strings from being processed.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bitbucket
Suse
Cross-Spawn