CVE-2024-21538

@@ -2,6 +2,17 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="6.0.6"></a>
+## [6.0.6](https://github.com/moxystudio/node-cross-spawn/compare/v6.0.5...v6.0.6) (2024-11-18)
+
+
+### Bug Fixes
+
+* disable regexp backtracking ([#160](https://github.com/moxystudio/node-cross-spawn/issues/160)) ([ba5aaef](https://github.com/moxystudio/node-cross-spawn/commit/ba5aaef))
+* **core:** support worker threads ([#127](https://github.com/moxystudio/node-cross-spawn/issues/127)) ([f4af31c](https://github.com/moxystudio/node-cross-spawn/commit/f4af31c))
+
+
+
 <a name="6.0.5"></a>
 ## [6.0.5](https://github.com/moxystudio/node-cross-spawn/compare/v6.0.4...v6.0.5) (2018-03-02)
 

@@ -1,6 +1,6 @@
 {
   "name": "cross-spawn",
-  "version": "6.0.5",
+  "version": "6.0.6",
   "description": "Cross platform child_process#spawn and child_process#spawnSync",
   "keywords": [
     "spawn",

@@ -1,6 +1,6 @@
 {
   "name": "cross-spawn",
-  "version": "6.0.5",
+  "version": "6.0.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

@@ -20,12 +20,12 @@ function escapeArgument(arg, doubleEscapeMetaChars) {
 
     // Sequence of backslashes followed by a double quote:
     // double up all the backslashes and escape the double quote
-    arg = arg.replace(/(?=\\*?)"/g, '$1$1\\"');
+    arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
 
     // Sequence of backslashes followed by the end of the string
     // (which will become a double quote later):
     // double up all the backslashes
-    arg = arg.replace(/(?=\\*?)$/, '$1$1');
+    arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1');
 
     // All other backslashes occur literally
 

@@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscapeMetaChars) {
     arg = `${arg}`;
 
     // Algorithm below is based on https://qntm.org/cmd
+    // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input
+    // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information
 
     // Sequence of backslashes followed by a double quote:
     // double up all the backslashes and escape the double quote
-    arg = arg.replace(/(\\*)"/g, '$1$1\\"');
+    arg = arg.replace(/(?=\\*?)"/g, '$1$1\\"');
 
     // Sequence of backslashes followed by the end of the string
     // (which will become a double quote later):
     // double up all the backslashes
-    arg = arg.replace(/(\\*)$/, '$1$1');
+    arg = arg.replace(/(?=\\*?)$/, '$1$1');
 
     // All other backslashes occur literally