#24 pact-cli@16.0.3 is using cross-spawn@7.0.3 that has a ReDoS vulnerability Issue created by danielnobusada Software versions • OS: Ubuntu 20.04 • Pact Node version: e.g. Pact Node v2.6.0 • Node Version: 18.20.4 Issue Checklist Please confirm the following: • I have upgraded to the latest • I have the read the FAQs in the Readme • I have triple checked, that there are no unhandled promises in my code • I have set my log level to debug and attached a log file showing the complete request/response cycle • For bonus points and virtual high fives, I have created a reproduceable git repository (see below) to illustrate the problem Expected behaviour Snyk not reporting vulnerabilities Actual behaviour Snyk tool indicates that cross-spawn@7.0.3 dependency has a ReDoS vulnerability [https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230] Steps to reproduce 1 - Add

@pact-foundation/pact-cli

to the package.json file and execute (

npm i @pact-foundation/pact-cli

or

yarn add @pact-foundation/pact-cli

) 2 - Run the snyk vulnerability check tool (locally or on a pipeline) For extra bonus points and internet karma, provide a repository, gist or reproducible code snippet so that we can test the problem. Relevant log files

✗ Regular Expression Denial of Service (ReDoS) [High Severity][<https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230>] in cross-spawn@7.0.3
    introduced by @pact-foundation/pact-cli@16.0.3 > cross-spawn@7.0.3
  This issue was fixed in versions: 7.0.5

pact-foundation/pact-js-cli