CVE-2024-21538
HighAdvisory
Published 8 Nov 2024In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.009
- 57th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 535
- of 17,787 indexed, latest versions
- Container images
- 549
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Regular Expression Denial of Service (ReDoS) in cross-spawn
Carried by container images the latest versions of 535 of 17,787 indexed charts deploy, on 549 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| cross-spawnnpm | 3.0.1, 4.0.2, 5.1.0, 6.0.5+3 more | 6.0.6, 7.0.5 | 549 |
- OSV records
- GHSA-3xgq-45jj-v275
Charts affected
535 by stars
Container images carrying it
549 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| jayfong/ | 163e5d621910 | cross-spawn | 6.0.6 | 1 |
| jhidalgo3/ | dfa8628d79f5 | cross-spawn | 7.0.5 | 1 |
| joplin/ | 3f7b852959aa | cross-spawn | 7.0.5 | 1 |
| joplin/ | 52af57880c0e | cross-spawn | 7.0.5 | 1 |
| joplin/ | b87564ef34e9 | cross-spawn | 7.0.5 | 1 |
| josepht05/ | 36cb0c618c94 | cross-spawn | 7.0.5 | 1 |
| josepht05/ | d94024965d78 | cross-spawn | 7.0.5 | 1 |
| josh5/ | 4d49c4816260 | cross-spawn | 7.0.5 | 1 |
| junktext/ | a70936c04aed | cross-spawn | 7.0.5 | 1 |
| junktext/ | d44adf5a4da2 | cross-spawn | 6.0.6 | 1 |
| jupyterhub/ | e3e6f3051df8 | cross-spawn | 6.0.6 | 1 |
| kaushaln1/ | e9f2d5dfdba0 | cross-spawn | 7.0.5 | 1 |
| keyoxide/ | 96f27a71269d | cross-spawn | 7.0.5 | 1 |
| kobotoolbox/ | bcacc01bccd4 | cross-spawn | 7.0.5 | 1 |
| koumoul/ | 7108d47be3b2 | cross-spawn | 6.0.6 | 1 |
| koumoul/ | 8eeca2e8285b | cross-spawn | 6.0.6 | 1 |
| ktitilayo2/ | 8bac28058688 | cross-spawn | 7.0.5 | 1 |
| kubebb/ | 0fbb732379bc | cross-spawn | 7.0.5 | 1 |
| kubebb/ | fd8ecbd73213 | cross-spawn | 7.0.5 | 1 |
| kubebb/ | fadac6d52470 | cross-spawn | 6.0.6 | 1 |
| kubebb/ | 258458311bc9 | cross-spawn | 6.0.6 | 1 |
| kubeflownotebookswg/ | 37300551dea6 | cross-spawn | 6.0.6 | 1 |
| kubesphere/ | f1b5bf878196 | cross-spawn | 6.0.6 | 1 |
| kubevious/ | 2d9ba6eb46b6 | cross-spawn | 7.0.5 | 1 |
| kubevious/ | f58226f9d84e | cross-spawn | 7.0.5 | 1 |
| kubevious/ | 9bf567704de2 | cross-spawn | 6.0.6 | 1 |
| kubevious/ | 1acf1a1f0b47 | cross-spawn | 6.0.6 | 1 |
| kubevious/ | 99ae7a5168c2 | cross-spawn | 7.0.5 | 1 |
| kubevious/ | 0b0f4c507eb6 | cross-spawn | 7.0.5 | 1 |
| kvalitetsit/ | 2b99cfa3c5df | cross-spawn | 6.0.6 | 1 |
| kyleslugg/ | ba8c36dfdfbd | cross-spawn | 7.0.5 | 1 |
| kyso/ | e52595c5c16f | cross-spawn | 6.0.6 | 1 |
| laly9999/ | dd0e503913e1 | cross-spawn | 7.0.5 | 1 |
| laly9999/ | 75ae77a20c6c | cross-spawn | 7.0.5 | 1 |
| langgenius/ | 4e65e8a351a2 | cross-spawn | 7.0.5 | 1 |
| langgenius/ | a2a294743634 | cross-spawn | 7.0.5 | 1 |
| langgenius/ | d64914ff0d6d | cross-spawn | 7.0.5 | 1 |
| lavandadelpatio/ | 501c3f31e0bc | cross-spawn | 7.0.5 | 1 |
| leeyoongti/ | 21d66cb76352 | cross-spawn | 6.0.6 | 1 |
| leonardomulticloud/ | e42a341e0299 | cross-spawn | 7.0.5 | 1 |
| library/ | 767230c0f263 | cross-spawn | 6.0.6 | 1 |
| library/ | 83f7bf209844 | cross-spawn | 7.0.5 | 1 |
| library/ | 0172f1c538e7 | cross-spawn | 7.0.5 | 1 |
| library/ | c5781ba340ef | cross-spawn | 7.0.5 | 1 |
| library/ | e2e2031c15be | cross-spawn | 7.0.5 | 1 |
| library/ | 1aae00775251 | cross-spawn | 7.0.5 | 1 |
| library/ | 8d6421d663b4 | cross-spawn | 7.0.5 | 1 |
| library/ | 8f693eaa7e0a | cross-spawn | 7.0.5 | 1 |
| linuxserver/ | a847b5b2d860 | cross-spawn | 6.0.6 | 1 |
| linuxserver/ | b801bbcf6386 | cross-spawn | 6.0.6 | 1 |