External/card-drop

[18] [HIGH] Regular Expression Denial of Service (ReDoS) in cross-spawn #458

New issue

Open

opened 2025-06-04 18:33:23 +01:00 by Vylpes · 2 comments

Vylpes commented

2025-06-04 18:33:23 +01:00

Owner

Package: cross-spawn
Affected versions: >= 7.0.0, < 7.0.5
Patched version: 7.0.5

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Package: `cross-spawn` Affected versions: `>= 7.0.0, < 7.0.5` Patched version: `7.0.5` --- Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Vylpes added this to the 0.10.0 milestone 2025-06-04 18:33:23 +01:00

Vylpes added the

label 2025-06-04 18:33:23 +01:00

Vylpes commented

2025-06-04 18:34:16 +01:00

Author

Owner

Transitive dependency cross-spawn 7.0.3 is introduced via

eslint 8.57.0
glob 10.4.5
jest 29.7.0
np 9.2.0
typeorm 0.3.20

Transitive dependency cross-spawn 7.0.3 is introduced via - eslint 8.57.0 - glob 10.4.5 - jest 29.7.0 - np 9.2.0 - typeorm 0.3.20

Vylpes commented

2025-06-04 18:34:48 +01:00

Author

Owner

Upgrade cross-spawn to version 7.0.5 or later. For example:

cross-spawn@^7.0.5:
  version "7.0.5"

Upgrade cross-spawn to version 7.0.5 or later. For example: ``` cross-spawn@^7.0.5: version "7.0.5" ```

Sign in to join this conversation.

No labels

requires documentation

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: External/card-drop#458

No description provided.