{"id":"CVE-2024-27980","aliases":["BIT-node-2024-27980","BIT-node-min-2024-27980","EUVD-2024-25154","GHSA-fm6v-wmjp-5rxq","SUSE-SU-2024:2496-1","SUSE-SU-2024:2542-1","SUSE-SU-2024:2543-1","SUSE-SU-2024:2574-1","openSUSE-SU-2024:14025-1","openSUSE-SU-2024:14214-1"],"status":"published","title":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a...","description":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01402,"percentile":0.72755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2024-06-15T00:00:00Z","modified":"2026-06-17T07:20:42Z","fixes":[{"ecosystem":"Bitnami","package":"node","fixed_in":["18.20.2","20.12.2","21.7.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["18.20.2","20.12.2","21.7.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs21","fixed_in":["21.7.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.2"},{"introduced":"19.0.0"},{"fixed":"20.12.2"},{"introduced":"21.0.0"},{"fixed":"21.7.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.20.2"},{"introduced":"19.0.0"},{"fixed":"20.12.2"},{"introduced":"21.0.0"},{"fixed":"21.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4-8.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4-150400.9.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4-150400.9.24.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.7.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-1.1"}]}],"bundled":5}],"products":[{"vendor":"node.js","product":"node.js"},{"vendor":"nodejs","product":"node"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/04/10/15","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/6","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/19/3","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MZN6PFXHTCCUENAKZXTGWPKUAHI6E2W/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUWBYDVCUSCX7YWTBX75LADMCVYFBGKU/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27980","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MZN6PFXHTCCUENAKZXTGWPKUAHI6E2W"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUWBYDVCUSCX7YWTBX75LADMCVYFBGKU"},{"url":"https://github.com/advisories/GHSA-fm6v-wmjp-5rxq"},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242496-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222665","tags":["report"]},{"url":"https://bugzilla.suse.com/1227554","tags":["report"]},{"url":"https://bugzilla.suse.com/1227560","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242542-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242543-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227561","tags":["report"]},{"url":"https://bugzilla.suse.com/1227562","tags":["report"]},{"url":"https://bugzilla.suse.com/1227563","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242574-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-27980","description":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.","status":"published","published":"2025-01-09T00:33:47.722Z","modified":"2025-04-30T22:25:25.133Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-25154","description":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.","status":"published","published":"2025-01-09T00:33:47Z","modified":"2025-04-30T22:25:25Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-fm6v-wmjp-5rxq","title":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a...","description":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.","status":"published","published":"2025-01-09T03:30:48Z","modified":"2025-01-10T00:30:36Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:59:27.400832Z"}],"nvd":[{"id":"CVE-2024-27980","description":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.","status":"published","published":"2025-01-09T01:15:08.367Z","modified":"2026-06-17T07:20:42.723Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"BIT-node-2024-27980","description":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.","status":"published","published":"2025-01-10T19:16:46.586Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2024-27980","description":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.","status":"published","published":"2025-01-10T19:16:46.302Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2024:14025-1","title":"corepack21-21.7.3-1.1 on GA media","description":"These are all security issues fixed in the corepack21-21.7.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:03.110627Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14214-1","title":"corepack20-20.15.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2026-02-04T02:56:34.982757Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2496-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.4:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n\nChanges in 18.20.3:\n\n- This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.\n  deps:\n  - acorn updated to 8.11.3.\n  - acorn-walk updated to 8.3.2.\n  - ada updated to 2.7.8.\n  - c-ares updated to 1.28.1.\n  - corepack updated to 0.28.0.\n  - nghttp2 updated to 1.61.0.\n  - ngtcp2 updated to 1.3.0.\n  - npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.\n  - simdutf updated to 5.2.4.\n\nChanges in 18.20.2:\n\n- CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)\n","status":"published","published":"2024-07-16T07:33:47Z","modified":"2026-02-04T04:00:02.522822Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2542-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.4:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n\nChanges in 18.20.3:\n\n- This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.\n  deps:\n  - acorn updated to 8.11.3.\n  - acorn-walk updated to 8.3.2.\n  - ada updated to 2.7.8.\n  - c-ares updated to 1.28.1.\n  - corepack updated to 0.28.0.\n  - nghttp2 updated to 1.61.0.\n  - ngtcp2 updated to 1.3.0.\n  - npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.\n  - simdutf updated to 5.2.4.\n\nChanges in 18.20.2:\n\n- CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)\n","status":"published","published":"2024-07-17T07:51:37Z","modified":"2026-02-04T04:15:38.206167Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2543-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-17T07:51:52Z","modified":"2026-02-04T03:44:28.883947Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2574-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-22T10:35:15Z","modified":"2026-02-04T03:46:39.426759Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}