High severity8.1NVD Advisory· Published Jan 9, 2025· Updated Apr 15, 2026
CVE-2024-27980
CVE-2024-27980
Description
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- www.openwall.com/lists/oss-security/2024/04/10/15nvd
- www.openwall.com/lists/oss-security/2024/07/11/6nvd
- www.openwall.com/lists/oss-security/2024/07/19/3nvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MZN6PFXHTCCUENAKZXTGWPKUAHI6E2W/nvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUWBYDVCUSCX7YWTBX75LADMCVYFBGKU/nvd
News mentions
0No linked articles in our index yet.