Command injection in NodeJS Node
Priority MEDIUM 40CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01402 72nd percentileScored 2026-11-07
Fix Fixed Node (NodeJS): 18.20.2, 20.12.2, 21.7.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | Node | 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 to before 18.20.2; 19.0 and later; 20.0 to before 20.12.2; 21.0 to before 21.7.3 | 18.20.2, 20.12.2, 21.7.3 | Patch available | CNA |
- Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 to before 18.20.2; 19.0 and later; 20.0 to before 20.12.2; 21.0 to before 21.7.3 Fixed in 18.20.2, 20.12.2, 21.7.3 Patch available CNA
Remediation
- Fix · CNA Node (NodeJS) Fixed in 18.20.2, 20.12.2, 21.7.3
Vendor assessments
Red Hat
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27980
- 2026-10-03 Alias added: GHSA-fm6v-wmjp-5rxq
References
Other 5
- http://www.openwall.com/lists/oss-security/2024/04/10/15
- http://www.openwall.com/lists/oss-security/2024/07/11/6
- http://www.openwall.com/lists/oss-security/2024/07/19/3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5MZN6PFXHTCCUENAKZXTGWPKUAHI6E2W/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JUWBYDVCUSCX7YWTBX75LADMCVYFBGKU/
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2024-27980 · CVE Program
- CVE-2024-27980 · NVD
- FIRST EPSS
- GHSA-fm6v-wmjp-5rxq · GitHub Advisory Database · CC BY 4.0
- CVE-2024-27980 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences