Security: High security vulnerability on cross-spawn (CVE-2024-21538)

[iresstai]

Summary

There's currently a high security vulnerability on cross-spawn package which requires a PATCH upgrade.

CVE-2024-21538
Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Details

PR automated by renovate needs to merged and released: #517