Description
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9Attack Vector: Network
Complexity: High
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages1 packages
🔴Vulnerability Details
2CVEListCVE-2024-27980: Due to the improper handling of batch files in child_process↗2025-01-09 GHSAGHSA-fm6v-wmjp-5rxq: Due to the improper handling of batch files in child_process↗2025-01-09 📋Vendor Advisories
2Red HatNode.js: Fail to Escape Arguments Properly in Microsoft Windows↗2024-04-09 DebianCVE-2024-27980: nodejs - Due to the improper handling of batch files in child_process.spawn / child_proce...↗2024 💬Community
1HackerOneBypass incomplete fix of CVE-2024-27980↗2024-07-09