CVE-2024-36138
Node.js: bypass of the CVE-2024-27980 batch file fix on Windows
Technology
Node.js
CVSS Score
8.1 / 10.0
Affected Versions
Node.js 18, 20 and 22 on Windows before the July 2024 releases
Upstream Fix
18.20.4; 20.15.1; 22.4.1
Published
September 7, 2024
OSSeva Coverage
Fixed upstream
Description
The fix for CVE-2024-27980 did not handle batch files with every possible extension, so a malicious argument to child_process.spawn or spawnSync on Windows could still inject commands and achieve code execution without the shell option. Rated High by Node.js. Fixed in 18.20.4, 20.15.1 and 22.4.1.
Is your Node.js deployment affected?
If you're running Node.js 18, 20 and 22 on Windows before the July 2024 releases, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js Node.js 18, 20 and 22 on Windows before the July 2024 releases?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?