CVE-2024-21538
Aliases:GHSA-3xgq-45jj-v275CGA-2282-wv9f-83hpCGA-22w2-v4r6-rf5wCGA-27r8-jx9w-hfj8CGA-2mw7-vjq2-vp6cCGA-2vf3-9h7c-qx6vCGA-38wc-f43v-59jjCGA-3gr2-cjxv-xwfcCGA-3mpq-48rp-pjrhCGA-3qx7-fhgm-235rCGA-4rh4-4985-5fvxCGA-5g3p-xgw7-jqw9CGA-6m7v-q3xx-mvx8CGA-7j3q-77g8-9455CGA-86gp-792p-fv88CGA-88jw-cqhp-jwqwCGA-8g7v-xx37-mcg8CGA-8hc7-8r9x-w7m6CGA-98px-3xqq-56r4CGA-9h83-rgf2-8xr6CGA-c4jr-32x6-w6ppCGA-c5rf-c6wp-8ggrCGA-cf9f-wjwh-j5crCGA-cfvm-xw8q-jxrmCGA-fvpj-x79r-f7wqCGA-ggwq-3wxc-v6hpCGA-gx3r-7gpv-p6g5CGA-h5w8-r55m-wg4jCGA-h78v-ph5r-p6mvCGA-jrxj-vmjv-h4x5CGA-jw92-997j-8x7qCGA-m38f-jhrr-jrh6CGA-mv4c-vqmp-g4r8CGA-p9h2-68f8-r62wCGA-pqp5-8w8j-9c58CGA-pwqm-wvfp-4jqpCGA-29j2-qqfx-3x63CGA-2j2x-6qxp-mjwhCGA-2j3w-gj86-ggqjCGA-2vcr-j46j-wr3xCGA-2w3v-r884-gh9pCGA-3r4q-43jj-vrv8CGA-42r6-8g5f-wgmwCGA-4596-jxwg-9w92CGA-45j5-wwcg-jfjrCGA-466j-r264-5v7qCGA-4m9p-fv2c-vp6xCGA-4vr3-47xr-68vgCGA-4vx5-3mqg-wg94CGA-4wc6-g2cf-3577CGA-4xg7-rm3m-964fCGA-53wf-gv9m-467hCGA-54hh-j7hp-w6g8CGA-5cph-q3xw-6qgrCGA-5gv5-j723-mh4gCGA-5pmm-m24c-gxmrCGA-5q53-6rcc-68m9CGA-5wgc-6gx9-xhf9CGA-5wgj-fwr3-h7mvCGA-6746-pf37-c5pmCGA-6fq6-mv5c-gg4qCGA-6jm9-j9q8-vrrgCGA-6vxc-3vxm-86cfCGA-6xcg-99gh-2p3wCGA-78h9-mq87-g69mCGA-7f68-x3wq-f4chCGA-7gch-3ff5-mj26CGA-7r5q-jq36-jg24CGA-7xmh-945j-297mCGA-87hq-r34x-4pq9CGA-88pm-4q3q-66h7CGA-8h32-46gh-rjjgCGA-8h8q-pm44-hg88CGA-8j2w-q6x6-hjrhCGA-8j73-f6h9-gpcmCGA-8qc3-2439-36p4CGA-93ff-pg98-2p9gCGA-97pp-96pw-gv2pCGA-9829-6rv4-33qqCGA-9r49-9rjw-3pghCGA-9vv5-pj22-qq94CGA-9w3g-mcfv-q2rpCGA-9w86-p44f-w2r4CGA-c5mf-6266-j53fCGA-c5qh-7wqr-6g3gCGA-c7ch-266r-frwvCGA-c7h7-8959-rf7pCGA-c97g-4p89-3r7pCGA-chv5-hmvj-2g9jCGA-f3h4-jrqw-mmxxCGA-f489-vr24-wc5fCGA-f59g-64xc-mfmrCGA-f5cc-x7fq-hrjjCGA-f5mw-frgj-frx3CGA-ffwh-w3r3-qxv2CGA-g426-pwfx-m3wqCGA-g6vw-w4cj-w7qgCGA-g956-vprf-7pp2CGA-grx7-wjc4-mv2fCGA-gvrx-vj22-hgr3CGA-gx72-2vj6-j46rCGA-h8jx-rvx3-pg68CGA-hp28-whjc-pxmjCGA-hppx-qj78-ffrqCGA-hrm2-wwpr-5rf9CGA-hxpc-chm7-p7c4CGA-j6w2-wfm4-xhj4CGA-jrg7-6fx2-h25rCGA-jvx2-3p8m-grf8CGA-m632-2gpq-gr8pCGA-m99x-pm9x-9cg6CGA-p5gh-q66x-c367CGA-p63w-94w4-q4r4CGA-p82v-qrmq-q6xxCGA-pghf-mfxp-jvw5CGA-pjhq-r343-cc6qCGA-pm46-8p3f-5j67CGA-q96h-px8q-4wmvCGA-q97j-9v22-h5h3CGA-qf2v-v7mf-mwwwCGA-qfm7-vrpq-829cCGA-qhxq-7rmv-7m2jCGA-rfvg-vpcx-w74pCGA-rhcx-ccvc-qh42CGA-rjq9-r8xg-9cv2CGA-rprr-jrvm-73v3CGA-rv29-vcmr-wm55CGA-rwfq-ffgq-v5g7CGA-rwj8-hqp4-cq9xCGA-v3q9-pj2r-3mxqCGA-vcvm-ccm8-g7qpCGA-vj9w-57p8-27q4CGA-vmf6-p634-m5fmCGA-vqgp-gww9-4c83CGA-vw2c-m58v-m3fvCGA-w3g4-2mg2-wcggCGA-w7m6-38gp-hpvcCGA-wh9g-4h7v-f2fjCGA-wh9h-m7qg-3hqcCGA-x787-xpmc-p3pvCGA-xh57-p67f-h9ccCGA-xm3f-rgf7-jg6cCGA-xmf3-hh3v-6h8mCGA-xq5f-88w2-rrr8CGA-xv63-h5fp-78mfCGA-378x-9rxc-cp3vCGA-q85w-m2xv-5q6m
Advisory lineage Upstream: 0 Downstream: 15
Deferred
Published: 08 Nov 2024, 05:00
Last modified:07 Aug 2026, 15:25
Vulnerability Summary
Overall Risk (default)
medium
35/100 CVSS Score
8.7 HIGH
v4.0 (cve.org)
EPSS Score
0.87% LOW
1% probability +0.80%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
08 Nov 2024, 05:00
Published
Vulnerability first disclosed
07 Aug 2026, 15:25
Last Modified
Vulnerability information updated
Description
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- v4.0•HIGH•Score: 7.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.87%• Percentile: 57%
Techniques & Countermeasures
- CWE-1333•Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Systems
- chainguard•airflow-2
< 2.11.0-r15
- chainguard•arangodb-3.11
< 3.11.14.5-r3
- chainguard•arangodb-3.12
< 3.12.9.4-r8
- chainguard•argo-workflows
< 3.6.0-r1
- chainguard•eslint
< 9.15.0-r0
- chainguard•graalvm-23
< 23.0.2-r3
- chainguard•graalvm-23-ce
< 23.0.2-r3
- chainguard•graalvm-23-ce-default-jdk
< 23.0.2-r3
- chainguard•graalvm-23-ce-jmods
< 23.0.2-r3
- chainguard•graalvm-23-ce-nodejs
< 23.0.2-r3
- chainguard•graalvm-23-ce-nodejs-default-jdk
< 23.0.2-r3
- chainguard•graalvm-23-ce-nodejs-jmods
< 23.0.2-r3
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
- chainguard•katib-suggestion-skopt-enas
< 0.19.0-r31
- chainguard•katib-tfevent-metricscollector
< 0.19.0-r31
- chainguard•kibana-7
< 7.17.25-r1
- chainguard•lerna
< 8.1.9-r1
- chainguard•node-gyp
< 10.3.1-r0
- chainguard•npm
< 0
- chainguard•npm-doc
< 0
- chainguard•opensearch-dashboards-2
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-alerting-dashboards-plugin
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-anomaly-detection-dashboards-plugin
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-config
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-dashboards-maps
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-dashboards-notifications
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-dashboards-observability
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-dashboards-query-workbench
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-dashboards-reporting
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-dashboards-search-relevance
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-dashboards-visualizations
< 2.18.0-r0
- chainguard•opensearch-dashboards-2-fips
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-alerting-dashboards-plugin
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-config
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-dashboards-maps
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-dashboards-notifications
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-dashboards-observability
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-dashboards-query-workbench
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-dashboards-reporting
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-dashboards-search-relevance
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-dashboards-visualizations
< 2.17.1-r1
- chainguard•opensearch-dashboards-2-fips-index-management-dashboards-plugin
< 2.17.1-r1
Showing first 50 affected entries in server-rendered view.
References (10)
- https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349
- https://github.com/moxystudio/node-cross-spawn/pull/160
- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f
- https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff
- https://nvd.nist.gov/vuln/detail/CVE-2024-21538
- https://github.com/moxystudio/node-cross-spawn/issues/165
- https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd
- https://github.com/moxystudio/node-cross-spawn
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21538.json