Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
CVSS Details
- CVSS 4.0 Base Score: 7.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade npm | Aug 8, 2025 | Nov 8, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade nodejs-npmUpgrade nodejs20-develUpgrade nodejs20Upgrade nodejs20-debuginfoUpgrade nodejs20-npmUpgrade nodejs20-debugsourceUpgrade nodejs20-full-i18nUpgrade v8-11.3-develUpgrade nodejs20-docsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs20-libsUpgrade nodejs-libsUpgrade v8-10.2-develUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-docs | Feb 17, 2025 | Nov 8, 2024 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Jan 21, 2026 | Jan 20, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 17, 2026 | Nov 8, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 8, 2024 |
| Suse | — | Upgrade nodejs20-develUpgrade corepack18Upgrade python311-pytestUpgrade python311-pytest-covUpgrade nodejs20Upgrade nodejs22-develUpgrade npm18Upgrade python311-boto3Upgrade corepack20Upgrade nodejs18Upgrade python311-botocoreUpgrade corepack22Upgrade nodejs18-docsUpgrade nodejs20-docsUpgrade nodejs18-develUpgrade nodejs22Upgrade velociraptorUpgrade nodejs22-docsUpgrade python311-coverageUpgrade python311-pytest-mockUpgrade npm20Upgrade aws-cliUpgrade npm22Upgrade python311-flakyUpgrade system-user-velociraptorUpgrade python311-pluggyUpgrade velociraptor-client | Dec 5, 2025 | Dec 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub