CVE-2024-21538

Summary

CVE-2024-21538 is a new vulnerability affecting versions of the package cross-spawn before 7.0.5. This issue involves a Regular Expression Denial of Service (ReDoS) weakness, where the application fails to adequately sanitize user input. Malicious actors can exploit this flaw by crafting an oversized and meticulously crafted string, leading to a significant increase in CPU usage and eventual program crash. The vulnerability poses a risk to system stability and resource availability. Users are advised to upgrade to the latest version of cross-spawn to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.