Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
CVSS Details
- CVSS 3.0 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Sep 7, 2024 |
| Suse | — | Upgrade nodejs20Upgrade nodejs22Upgrade npm20Upgrade npm18Upgrade nodejs22-develUpgrade corepack20Upgrade nodejs20-docsUpgrade npm22Upgrade nodejs22-docsUpgrade nodejs18-develUpgrade nodejs18Upgrade corepack22Upgrade corepack18Upgrade nodejs20-develUpgrade nodejs18-docs | Jul 17, 2024 | Jul 16, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub