[BUG] CVE-2024-21538 - cross-spawn to 7.0.5+

@wraithgar

Is there an existing issue for this?

I have searched the existing issues

This issue exists in the latest npm version

I am using the latest npm

Current Behavior

@wraithgar Since we cannot create updates of bundled node_modules, could you please bump the cross-spawn to 7.0.5 or higher?
https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230

Expected Behavior

No response

Steps To Reproduce

In this environment...
With this config...
Run '...'
See error...

Environment

npm:
Node.js:
OS Name:
System Model Name:
npm config:

; copy and paste output from `npm config ls` here

Note that this vulnerability is rated as "High".

indeed, but since you'd have to be attacking yourself to trigger the ReDOS in npm, it's not actually a vulnerability here.

Any update on this?

any update on this issue?

As a workaround, if you're using the Trivy GitHub action, you could exclude the bundled package from the scan by specifying e.g.

uses: aquasecurity/trivy-action
with:
  skip-dirs: node_modules,/usr/local/lib/node_modules/npm/node_modules/cross-spawn

Update: For some reason, this only works with my local trivy CLI, not the GitHub action.

Another workaround is simply creating a .trivyignore file, and adding CVE-2024-21538 to it.

By the way, they have just released a new version - 7.0.6 .
https://www.npmjs.com/package/cross-spawn

I am running into the same issue. I first tried to use the override in package.json but that didn't work because cross-spawn is a bundled dependency of another dep.

I am using better-npm-audit for the project, so adding the following the .nsprc file allows temporary bypass for that package.

{
  "1100467": {
    "active": true,
    "notes": "Waiting for https://github.com/npm/cli/issues/7902 to be resolved",
    "expiry": "2024-12-31"
  }
}

This is preventing my team from deploying because of an automated security scan in google cloud. I know the vulnerability is basically a non-issue in the context of the cli, but the scan does not.

Please bump past the vulnerable version as part of the weekly release. From the lockfile, I think the cli only has it as a transitive dependency, and the transitives have version ranges compatible with the fixed version so it shouldn't be too hard and it's make a huge difference to anyone at the mercy of automated security scans they can't control.

I'd be happy to try and do it myself, but the contribution guidelines explicitly disallow third party fixes for dependencies.

For us this was a non-issue because we realized don't really need cross-spawn in the deployed image.

The fix is simple when that is the case. In the Docker image we deploy, simply removed cross-spawn package from node_modules regarding npm, for example:

RUN rm -r /usr/local/lib/node_modules/npm/node_modules/cross-spawn/
RUN rm -r /usr/lib/node_modules_20/npm/node_modules/cross-spawn/
RUN rm -r /usr/local/n/versions/node/18.20.5/lib/node_modules/npm/node_modules/cross-spawn/

This also made me realize that we don't need npm either, and will go even further to remove it too.

I know that some projects need npm in the final image so this solution won't work, but in case you're only using npm to build the app, it's possible you want only the built assets in the final image and don't need npm anyway.

So actually for us this was an improvement in reducing the threat surface of our deployed app 😸

Thank you, I really appreciate your offering a solution. We're trying something similar, but it'd be nice not to have to and I don't know what a project that needed npm in the final image would do.

I'm guessing here, but if you need updated cross-spawn in the deployed image couldn't you follow an approach similar to deleting it?

cd /usr/local/n/versions/node/<your version here>/lib/node_modules/npm/
rm -r node_modules/cross-spawn
npm install cross-spawn@7.0.6

When this will be fix?

@gidsola

honestly, the wide use of npm alone should be cause enough to keep it updated. To let it go a week?? srsly, professionalism is gone these days.

@gidsola Give them a break, we're talking about open-source code here, you know how these things go -- they're maintained by overworked volunteers who could probably use a break from aggressive remarks like these

Their release process says they do releases on Wednesdays. Out-of-band releases could happen for critical vulns, but they don't say that about high vulns. I'm hopeful that we'll see a resolution tomorrow.

Source: https://github.com/npm/cli/wiki/Release-Process#overview

also, it's not actually a vulnerability based on its usage in npm, so it shouldn't be blocking anyone unless their security policies are incorrectly over-rigid.

@gidsola

@gidsola Give them a break, we're talking about open-source code here, you know how these things go -- they're maintained by overworked volunteers who could probably use a break from aggressive remarks like these

You are right.
I apologize.
bad morning, no excuse.

As has been pointed out already, this is not a critical vulnerability, it is a false positive. The package itself has a vulnerability but it does not affect npm. This will be updated w/ the next npm release which should be soon.

@wraithgar

@wraithgar is this confirmed fixed in https://nodejs.org/en/blog/release/v20.18.1? I could have sworn I saw the release notes for 20.18.1 on 11/13/2024.

@wraithgar

@wraithgar and other maintainers-

I'm following these:

It does not appear that Node v20.18.1, shipping with npm v10.8.2, addresses this CVE. Checking the package-lock for npm v10.8.2, cross-spawn is still at a vulnerable level of v7.0.3. So, it's still unclear to me that uplifting from v20.18.0 to v20.18.1 will remediate this issue.

Will there be another Node v20.18.1+ release prior to next Wednesday?

The last few versions of node 20 always shipped with npm 10.8.2, and I doubt this will be changed soon given that there has been 10.8.3 and 10.9.0 for a while but only node 22 gets shipped with npm 10.9.0

Node is not npm and vice versa, even if npm is bundled when installing node. You can, and should, upgrade your npm independently from node and always do so after a fresh install of node

Npm hasn't released 10.9.1 with the fix yet, so I don't see how node would have addressed this in 20.18.1. It's much more likely that node 22 will get that upgrade before node 20

For us this was a non-issue because we realized don't really need cross-spawn in the deployed image.

The fix is simple when that is the case. In the Docker image we deploy, simply removed cross-spawn package from node_modules regarding npm, for example:
RUN rm -r /usr/local/lib/node_modules/npm/node_modules/cross-spawn/
RUN rm -r /usr/lib/node_modules_20/npm/node_modules/cross-spawn/
RUN rm -r /usr/local/n/versions/node/18.20.5/lib/node_modules/npm/node_modules/cross-spawn/
This also made me realize that we don't need npm either, and will go even further to remove it too.

I know that some projects need npm in the final image so this solution won't work, but in case you're only using npm to build the app, it's possible you want only the built assets in the final image and don't need npm anyway.

So actually for us this was an improvement in reducing the threat surface of our deployed app 😸

I can confirm this worked for my gcloud build. thanks!

Fixed in npm 10.9.1 (and 9.9.4)

Change image node:22.14.0-alpine3.21

@wraithgar

@wraithgar Node 18 and Node 20 still ship npm v10.8.2 and don't include this update.

Since they're both in maintenance, should they have been upgraded to v10.9.1 or should the package bump have been backported to release v10.8.3? If the maintenance policy doesn't cover this scenario, does this mean that should be expecting to disable scanning for vulnerabilities that show up in NPM for anything but the most recent stable major version?

10.9.1 should have been backported. I don't know why they weren't. That is normally something node does on their own, we are not in control of that.

Node 18 is going EOL imminently so it's unlikely that will be patched. But again we don't have a lot of control there.

If the npm team put up a PR to backport an npm update to the 18 branch, I suspect it would make it in.

Navigation Menu

Repository navigation

[BUG] CVE-2024-21538 - cross-spawn to 7.0.5+ #7902

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[BUG] CVE-2024-21538 - cross-spawn to 7.0.5+ #7902

Description

Is there an existing issue for this?

This issue exists in the latest npm version

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

Activity

CraigAtInstrumental commented on Nov 14, 2024

ljharb commented on Nov 14, 2024

Mayvis commented on Nov 18, 2024

klever34 commented on Nov 18, 2024

MasterCarl commented on Nov 18, 2024

klever34 commented on Nov 18, 2024

planv commented on Nov 18, 2024

lempira commented on Nov 19, 2024

SpencerWhitehead7 commented on Nov 19, 2024

luka-papez commented on Nov 19, 2024

SpencerWhitehead7 commented on Nov 19, 2024

luka-papez commented on Nov 19, 2024

harshit-gupta-simplisafe commented on Nov 19, 2024

8 remaining items

beavuck commented on Nov 19, 2024

beavuck commented on Nov 19, 2024

ljharb commented on Nov 19, 2024

gidsola commented on Nov 19, 2024

wraithgar commented on Nov 20, 2024

warnerjc commented on Nov 20, 2024

warnerjc commented on Nov 21, 2024

Tofandel commented on Nov 21, 2024

humam-nameer-10p commented on Nov 21, 2024

wraithgar commented on Nov 21, 2024

ramblingenzyme commented on Apr 28, 2025

wraithgar commented on Apr 28, 2025

ljharb commented on Apr 28, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions