CVE-2024-21538CWE-1333

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper…

High · published November 8, 2024

CVSS v4.0
8.7
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00868 · 58.3th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-11-08T05:00Z
EPSS history
Timeline
  • 08 NOV 05:00Z
    Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper…
    cvelistv5