Every CVE Search/ Get API key

CVE-2024-27980

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a...

8.1 HighFix available

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.40%Up 1.4 points since Jan 9, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.1

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Record
CVE-2024-27980
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
EUVDEUVD-2024-25154 8.1

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Record
EUVD-2024-25154
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-fm6v-wmjp-5rxq 8.1

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a...

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Record
GHSA-fm6v-wmjp-5rxq
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
NVD 8.1

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Record
CVE-2024-27980
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSVBIT-node-2024-27980 No score

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Record
BIT-node-2024-27980
Updated
2026-11-02
OSVBIT-node-min-2024-27980 No score

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Record
BIT-node-min-2024-27980
Updated
2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2024:14025-1 No score

corepack21-21.7.3-1.1 on GA media

These are all security issues fixed in the corepack21-21.7.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14025-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14214-1 No score

corepack20-20.15.1-1.1 on GA media

These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14214-1
Updated
2026-11-02
OSVSUSE-SU-2024:2496-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to 18.20.4:

  • CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
  • CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)

Changes in 18.20.3:

  • This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections. deps:
    • acorn updated to 8.11.3.
    • acorn-walk updated to 8.3.2.
    • ada updated to 2.7.8.
    • c-ares updated to 1.28.1.
    • corepack updated to 0.28.0.
    • nghttp2 updated to 1.61.0.
    • ngtcp2 updated to 1.3.0.
    • npm updated to 10.7.0. Includes a fix from [email protected] to limit the number of open connections npm/cli#7324.
    • simdutf updated to 5.2.4.

Changes in 18.20.2:

  • CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)
Record
SUSE-SU-2024:2496-1
Updated
2026-11-02
OSVSUSE-SU-2024:2542-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to 18.20.4:

  • CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
  • CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)

Changes in 18.20.3:

  • This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections. deps:
    • acorn updated to 8.11.3.
    • acorn-walk updated to 8.3.2.
    • ada updated to 2.7.8.
    • c-ares updated to 1.28.1.
    • corepack updated to 0.28.0.
    • nghttp2 updated to 1.61.0.
    • ngtcp2 updated to 1.3.0.
    • npm updated to 10.7.0. Includes a fix from [email protected] to limit the number of open connections npm/cli#7324.
    • simdutf updated to 5.2.4.

Changes in 18.20.2:

  • CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)
Record
SUSE-SU-2024:2542-1
Updated
2026-11-02
OSVSUSE-SU-2024:2543-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

  • CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
  • CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
  • CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
  • CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
  • CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

  • test_runner: support test plans
  • inspector: introduce the --inspect-wait flag
  • zlib: expose zlib.crc32()
  • cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

  • src,permission: throw async errors on async APIs
  • test_runner: support forced exit

Changes in 20.13.1:

  • buffer: improve base64 and base64url performance
  • crypto: deprecate implicitly shortened GCM tags
  • events,doc: mark CustomEvent as stable
  • fs: add stacktrace to fs/promises
  • report: add --report-exclude-network option
  • src: add uv_get_available_memory to report and process
  • stream: support typed arrays
  • util: support array of formats in util.styleText
  • v8: implement v8.queryObjects() for memory leak regression testing
  • watch: mark as stable
Record
SUSE-SU-2024:2543-1
Updated
2026-11-02
OSVSUSE-SU-2024:2574-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

  • CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
  • CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
  • CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
  • CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
  • CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

  • test_runner: support test plans
  • inspector: introduce the --inspect-wait flag
  • zlib: expose zlib.crc32()
  • cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

  • src,permission: throw async errors on async APIs
  • test_runner: support forced exit

Changes in 20.13.1:

  • buffer: improve base64 and base64url performance
  • crypto: deprecate implicitly shortened GCM tags
  • events,doc: mark CustomEvent as stable
  • fs: add stacktrace to fs/promises
  • report: add --report-exclude-network option
  • src: add uv_get_available_memory to report and process
  • stream: support typed arrays
  • util: support array of formats in util.styleText
  • v8: implement v8.queryObjects() for memory leak regression testing
  • watch: mark as stable
Record
SUSE-SU-2024:2574-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
node
Bitnami
 before 18.20.2, 19.0.0 up to 20.12.2, 21.0.0 up to 21.7.3
18.20.220.12.221.7.3
node-min
Bitnami
 before 18.20.2, 19.0.0 up to 20.12.2, 21.0.0 up to 21.7.3
18.20.220.12.221.7.3
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 3 CVEs
 before 18.20.4-8.24.1
18.20.4-8.24.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
From an advisory covering 3 CVEs
 before 18.20.4-150400.9.24.2
18.20.4-150400.9.24.2
nodejs18
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 18.20.4-150400.9.24.2
18.20.4-150400.9.24.2
nodejs20
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
From an advisory covering 6 CVEs
 before 20.15.1-150500.11.12.2
20.15.1-150500.11.12.2
nodejs20
openSUSE:Leap 15.5
From an advisory covering 6 CVEs
 before 20.15.1-150500.11.12.2
20.15.1-150500.11.12.2
nodejs20
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 6 CVEs
 before 20.15.1-150600.3.3.2
20.15.1-150600.3.3.2
nodejs20
openSUSE:Leap 15.6
From an advisory covering 6 CVEs
 before 20.15.1-150600.3.3.2
20.15.1-150600.3.3.2
nodejs21
openSUSE:Tumbleweed
 before 21.7.3-1.1
21.7.3-1.1
nodejs20
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 20.15.1-1.1
20.15.1-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-27980 is a high vulnerability (CVSS 8.1) in Node.js, published June 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in node 18.20.2.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open