Regarding CVE-2024-21538

[frederi-co]

Hi,

We are maintaining nodejs images and have recently performed some vulnerability scan. The cross-spawn package that is installed is 7.0.3. Is there any plans to bundle the latest version of cross-spawn (7.0.5, which has fix the CVE) to the latest node distribution?

      "VulnerabilityID": "CVE-2024-21538",
      "PkgID": "cross-spawn@7.0.3",
      "PkgName": "cross-spawn",
      "PkgPath": "opt/node/lib/node_modules/npm/node_modules/cross-spawn/package.json",
      "PkgIdentifier": {
        "PURL": "pkg:npm/cross-spawn@7.0.3",
        "UID": "ab88a138895277fa"
      },
      "InstalledVersion": "7.0.3",
      "FixedVersion": "7.0.5, 6.0.6",
      "Status": "fixed"

Rgds

[ljharb]

That's part of npm, so npm would have to update itself, and then node would have to update npm.

However, I'm pretty sure the latest version of node has this done already. What version of node and npm are you using?

[frederi-co]

We are on node 20.19.0 and npm 10.8.2

[richardlau]

We are on node 20.19.0 and npm 10.8.2

Discussion in nodejs/nodejs-dependency-vuln-assessments#193.