Skip to content

Conversation

@sandeepkasera
Copy link

This PR upgrades the cross-spawn from version 5.0.1 to 7.0.6.

##Reason for Upgrade
Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to
improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well
crafted string.

##Changes Made
Updated package.json

##Linked Issues
Fixes #167

@mgagliardo91
Copy link

Can we get this in so we can avoid overriding the cross-spawn dep?

@Tzahile
Copy link

Tzahile commented Mar 13, 2025

@sandeepkasera I got approved, please push it
(or someone from the contributors @mgagliardo91 @serhii-boiko )

@sandeepkasera
Copy link
Author

@Tzahile I do not have the necessary permissions to merge this pull request.

@serlight1
Copy link

Can anybody merge this MR? It's really necessary to avoid ReDoS

@kevinfmanning
Copy link

Can this ACTUALLY get reviewed/merged?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upgrade cross-spawn Dependency to Address Security Vulnerability (ReDoS)

6 participants