CVE-2024-27980
Fixed in a distro release EPSS 1%CVSS 8.1
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | nodejs-16 | 16.20.2-r16 |
| Chainguard | nodejs-16-doc | 16.20.2-r16 |
| Chainguard | nodejs-18 | 18.20.2-r0 |
| Chainguard | nodejs-18-doc | 18.20.2-r0 |
| Chainguard | nodejs-20 | 20.12.2-r0 |
| Chainguard | nodejs-20-doc | 20.12.2-r0 |
| Chainguard | nodejs-21 | 21.7.3-r0 |
| Chainguard | nodejs-21-doc | 21.7.3-r0 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 18.20.4-8.24.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs18 | 18.20.4-150400.9.24.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.15.1-150500.11.12.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP6 | nodejs20 | 20.15.1-150600.3.3.2 |
| Wolfi | nodejs-16 | 16.20.2-r16 |
| Wolfi | nodejs-16-doc | 16.20.2-r16 |
| Wolfi | nodejs-18 | 18.20.2-r0 |
| Wolfi | nodejs-18-doc | 18.20.2-r0 |
| Wolfi | nodejs-20 | 20.12.2-r0 |
| Wolfi | nodejs-20-doc | 20.12.2-r0 |
| Wolfi | nodejs-21 | 21.7.3-r0 |
| Wolfi | nodejs-21-doc | 21.7.3-r0 |
| openSUSE Leap 15.5 | nodejs18 | 18.20.4-150400.9.24.2 |
| openSUSE Leap 15.5 | nodejs20 | 20.15.1-150500.11.12.2 |
| openSUSE Leap 15.6 | nodejs20 | 20.15.1-150600.3.3.2 |
| openSUSE Tumbleweed | nodejs20 | 20.15.1-1.1 |
| openSUSE Tumbleweed | nodejs21 | 21.7.3-1.1 |