CVE-2024-36138
Fixed in a distro release EPSS 1%CVSS 8.1
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Products: NodeJS Node, nodejs
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | nodejs-16 | 16.20.2-r16 |
| Chainguard | nodejs-21 | 21.7.3-r13 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 18.20.4-8.24.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs18 | 18.20.4-150400.9.24.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.15.1-150500.11.12.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP6 | nodejs20 | 20.15.1-150600.3.3.2 |
| Wolfi | nodejs-16 | 16.20.2-r16 |
| Wolfi | nodejs-21 | 21.7.3-r13 |
| openSUSE Leap 15.5 | nodejs18 | 18.20.4-150400.9.24.2 |
| openSUSE Leap 15.5 | nodejs20 | 20.15.1-150500.11.12.2 |
| openSUSE Leap 15.6 | nodejs20 | 20.15.1-150600.3.3.2 |
| openSUSE Tumbleweed | nodejs22 | 22.10.0-1.1 |
| openSUSE Tumbleweed | nodejs24 | 24.11.1-2.1 |
| openSUSE Tumbleweed | nodejs26 | 26.3.1-1.1 |