[Bug]: CVE-2024-21538 jest using a vulnerable library [email protected]

[AlexeyS-eng]

Version

29.7.0

Steps to reproduce

Installing latest jest version introduces high vulnerability (8.7) CVE-2024-21538

Expected behavior

Vulnerability score from high to below high threshold

Actual behavior

Vulnerability scan not passing in the CICD pipeline.

Additional context

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

npm list cross-spawn:
└─┬ [email protected]
└─┬ @jest/[email protected]
└─┬ [email protected]
└─┬ [email protected]
└── [email protected]

Environment

System:
    OS: macOS 15.1
    CPU: (10) arm64 Apple M1 Pro
  Binaries:
    Node: 20.18.0 - ~/.nvm/versions/node/v20.18.0/bin/node
    npm: 10.8.2 - ~/.nvm/versions/node/v20.18.0/bin/npm
  npmPackages:
    jest: ^29.6.4 => 29.7.0

[ibakirov]

This bug is duplicate for #15379

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 30 days.