[vmrh21]

Date: 2026-02-19

Summary

This PR fixes CVE-2024-21538 by adding an npm override to force cross-spawn to version 7.0.6 across all dependencies.

CVE Details

• CVE ID: CVE-2024-21538
• Package: cross-spawn
• Severity: HIGH (CVSS 7.5)
• Impact: Regular Expression Denial of Service (ReDoS) in argument parsing
• Attack Vector: Processing malicious command-line arguments
• Vulnerable versions: <6.0.6 || >=7.0.0 <7.0.5
• Fixed version: 7.0.6
• Jira Issues: RHOAIENG-15602, RHOAIENG-15601, RHOAIENG-15600, RHOAIENG-15596, RHOAIENG-15598, RHOAIENG-15599, RHOAIENG-15597, RHOAIENG-17795

Test Results

Status: ✅ All tests passed

Tests discovered: Yes
Test command: npm test
Result: PASSED
Duration: ~30s

Test Summary

• Total: 30 tests
• Passed: 30
• Failed: 0
• Skipped: 0

Backend: All type checks passed
Frontend: 4 test suites passed

Changes Made

• Added npm override: "cross-spawn": "^7.0.6" in root package.json
• Updated all monorepo lock files (root, backend, frontend)
• No application code changes required

Breaking Changes

None - this is a pure security patch with no API changes. Version 7.0.6 is backward compatible with 7.0.x.

Testing Checklist

• Pre-PR automated tests executed and passed
• Verified cross-spawn@7.0.6 installed via npm list cross-spawn
• Confirmed CVE-2024-21538 no longer in npm audit
• Build successful
• All test suites passed
• Manual testing (if applicable)

Risk Assessment

Risk Factor	Level	Notes
Breaking Changes	None	Security patch only
Dependency Impact	Low	Used by test runners and build tools
Regression Risk	Low	No code changes, all tests pass

Verification Steps

1. Verify CVE resolved:

   npm audit | grep CVE-2024-21538
   # Should return no results

2. Verify cross-spawn version:

   npm list cross-spawn
   # Should show 7.0.6

3. Run tests:

   npm test
   # All tests should pass

References

• CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2024-21538
• GitHub Advisory: GHSA-3xgq-45jj-v275
• cross-spawn Security Patch: https://github.com/moxystudio/node-cross-spawn/releases/tag/v7.0.6

---

🤖 Generated by CVE Fixer Workflow