diff --git a/packages/common/package.json b/packages/common/package.json
index 5803375623..a072e9f09d 100644
--- a/packages/common/package.json
+++ b/packages/common/package.json
@@ -23,7 +23,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/lodash-es": "4.17.12",
     "@types/mocha": "^10.0.9",
-    "cross-spawn": "7.0.3",
+    "cross-spawn": "7.0.5",
     "fast-check": "3.22.0",
     "js-yaml": "^4.1.0",
     "mocha": "^10.7.3"
diff --git a/packages/test-harness/package.json b/packages/test-harness/package.json
index 462f482af5..2e403f2111 100644
--- a/packages/test-harness/package.json
+++ b/packages/test-harness/package.json
@@ -40,7 +40,7 @@
     "@types/mocha": "^10.0.9",
     "@types/tail": "2.2.3",
     "@vscode/test-electron": "^2.4.1",
-    "cross-spawn": "7.0.3",
+    "cross-spawn": "7.0.5",
     "mocha": "^10.7.3"
   },
   "types": "./out/runners/extensionTestsNeovim.d.ts",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index bc65075388..fdba3933e3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -224,8 +224,8 @@ importers:
         specifier: ^10.0.9
         version: 10.0.9
       cross-spawn:
-        specifier: 7.0.3
-        version: 7.0.3
+        specifier: 7.0.5
+        version: 7.0.5
       fast-check:
         specifier: 3.22.0
         version: 3.22.0
@@ -951,8 +951,8 @@ importers:
         specifier: ^2.4.1
         version: 2.4.1
       cross-spawn:
-        specifier: 7.0.3
-        version: 7.0.3
+        specifier: 7.0.5
+        version: 7.0.5
       mocha:
         specifier: ^10.7.3
         version: 10.7.3
@@ -4369,6 +4369,10 @@ packages:
     resolution: {integrity: sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==}
     engines: {node: '>= 8'}
 
+  cross-spawn@7.0.5:
+    resolution: {integrity: sha512-ZVJrKKYunU38/76t0RMOulHOnUcbU9GbpWKAOZ0mhjr7CX6FVrH+4FrAapSOekrgFQ3f/8gwMEuIft0aKq6Hug==}
+    engines: {node: '>= 8'}
+
   crypto-random-string@2.0.0:
     resolution: {integrity: sha512-v1plID3y9r/lPhviJ1wrXpLeyUIGAZ2SHNYTEapm7/8A9nLPoyvVp3RK/EPFqn5kEznyWgYZNsRtYYIWbuG8KA==}
     engines: {node: '>=8'}
@@ -14767,6 +14771,12 @@ snapshots:
       shebang-command: 2.0.0
       which: 2.0.2
 
+  cross-spawn@7.0.5:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
   crypto-random-string@2.0.0: {}
 
   crypto-random-string@4.0.0:
@@ -15634,7 +15644,7 @@ snapshots:
       '@ungap/structured-clone': 1.2.0
       ajv: 6.12.6
       chalk: 4.1.2
-      cross-spawn: 7.0.3
+      cross-spawn: 7.0.5
       debug: 4.3.7(supports-color@8.1.1)
       doctrine: 3.0.0
       escape-string-regexp: 4.0.0
@@ -15681,7 +15691,7 @@ snapshots:
       '@types/json-schema': 7.0.15
       ajv: 6.12.6
       chalk: 4.1.2
-      cross-spawn: 7.0.3
+      cross-spawn: 7.0.5
       debug: 4.3.7(supports-color@8.1.1)
       escape-string-regexp: 4.0.0
       eslint-scope: 8.1.0
@@ -15786,7 +15796,7 @@ snapshots:
 
   execa@5.1.1:
     dependencies:
-      cross-spawn: 7.0.3
+      cross-spawn: 7.0.5
       get-stream: 6.0.1
       human-signals: 2.1.0
       is-stream: 2.0.1
@@ -16016,7 +16026,7 @@ snapshots:
 
   foreground-child@3.3.0:
     dependencies:
-      cross-spawn: 7.0.3
+      cross-spawn: 7.0.5
       signal-exit: 4.1.0
 
   fork-ts-checker-webpack-plugin@6.5.3(eslint@9.12.0(jiti@1.21.6))(typescript@5.6.3)(webpack@5.95.0(esbuild@0.24.0)):
@@ -19652,7 +19662,7 @@ snapshots:
       address: 1.2.2
       browserslist: 4.24.0
       chalk: 4.1.2
-      cross-spawn: 7.0.3
+      cross-spawn: 7.0.5
       detect-port-alt: 1.1.6
       escape-string-regexp: 4.0.0
       filesize: 8.0.7