← CVE Intelligence

CVE-2024-36138

NodeJS / Node PUBLISHED

Description (CNA)

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Affected (CNA)

Vendor / productVersions
NodeJS / Nodeaffected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.*; affected 17.0 before 17.*; affected 18.0 before 18.20.4; affected 19.0 before 19.*; affected 20.0 before 20.15.1; affected 21.0 before 21.*; affected 22.0 before 22.4.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.