npm package
cross-spawn vulnerabilities by version
The latest release, 7.0.6 (Nov 18, 2024), has no known vulnerabilities. 10% of last week’s 276.6M downloads went to versions with known vulnerabilities. OSV.dev lists 1 advisory for cross-spawn; the newest was published on Nov 8, 2024.
npm (opens in a new tab) describes it as “Cross platform child_process#spawn and child_process#spawnSync”
- Latest release
- 7.0.6
- Nov 18, 2024, no known vulnerabilities
- Downloads last week
- 276.6M
- All versions, from npm
- Advisories on OSV.dev
- 1
- Newest Nov 8, 2024
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable cross-spawn
10% of last week’s 276.6M cross-spawn downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. cross-spawn doesn’t publish support dates we can check.
Newest advisories
The 1 most recently published, with the versions each one affects.
CriticalCVE-2024-21538 on OSV.dev (opens in a new tab)GHSA-3xgq-45jj-v275
Regular Expression Denial of Service (ReDoS) in cross-spawn
Affects >= 7.0.0, < 7.0.5; < 6.0.6. Published Nov 8, 2024.
Which cross-spawn do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for cross-spawn, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.