npm-run-all2-6.2.2.tgz: 1 vulnerabilities (highest severity is: 7.5) unreachable #571
Description
Vulnerable Library - npm-run-all2-6.2.2.tgz
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (npm-run-all2 version) | Remediation Possible** | Reachability |
|---|---|---|---|---|---|---|---|
| CVE-2024-21538 |  High |
7.5 | cross-spawn-7.0.3.tgz | Transitive | N/A* | ❌ |
|
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-21538
Vulnerable Library - cross-spawn-7.0.3.tgz
Cross platform child_process#spawn and child_process#spawnSync
Library home page: https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz
Dependency Hierarchy:
- npm-run-all2-6.2.2.tgz (Root Library)
- ❌ cross-spawn-7.0.3.tgz (Vulnerable Library)
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
Publish Date: 2024-11-08
URL: CVE-2024-21538
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-21538
Release Date: 2024-11-08
Fix Resolution: cross-spawn - 7.0.5