PT-2024-4625 · Node.Js+1 · Node.Js+1
Tianst
·
Published
2024-07-08
·
Updated
2026-05-18
·
CVE-2024-36138
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Node.js versions up to 18.20.3
Node.js versions up to 20.15.0
Node.js versions up to 22.4.0
Description:
The issue arises from improper handling of batch files with all possible extensions on Windows via
child process.spawn / child process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled. This allows a remote attacker to execute arbitrary commands.Recommendations:
For Node.js versions up to 18.20.3, update to a version higher than 18.20.3 to resolve the issue.
For Node.js versions up to 20.15.0, update to a version higher than 20.15.0 to resolve the issue.
For Node.js versions up to 22.4.0, update to a version higher than 22.4.0 to resolve the issue.
As a temporary workaround, consider disabling the use of
child process.spawn and child process.spawnSync functions until a patch is available.Fix
RCE
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Node.Js
Suse