cross-spawn ReDoS
Regular expression denial of service in argument parsing
Severity CVSS
HIGH 7.5
Exploitation Shoulder
No known exploits
Fix available
No patch yet
How to fix
Affected packages
npm
cross-spawn
Is this in your code?
Shoulder scans your codebase and tells you if CVE-2024-21538 is reachable — not just present.
npx @shoulderdev/cli trust .
Technical details
Risk by Environment
Production (public-facing)
HIGH
Patch soon. Exploitation requires specific conditions but impact is severe.
Staging
MEDIUM
Schedule patch. Review if this environment is network-accessible.
Internal services
MEDIUM
Assess exposure. Patch if the service handles sensitive data.
Local dev only
LOW
Minimal risk in isolated dev environments.
Detection Rules 11 rules
CWE-1333
3 rules
Inefficient Regular Expression Complexity
Regular Expression Denial of Service
Regular Expression Denial of Service (ReDoS)
Regular Expression Denial of Service (ReDoS)
CWE-400
8 rules
Uncontrolled Resource Consumption
LLM Denial of Service
Missing Request Size Limits
Denial of Service via Resource Exhaustion