Description
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NodeJS | Node | 4.0 – < 4.*, 5.0 – < 5.*, 6.0 – < 6.*, 7.0 – < 7.*, 8.0 – < 8.*, 9.0 – < 9.*, 10.0 – < 10.*, 11.0 – < 11.*, 12.0 – < 12.*, 13.0 – < 13.*, 14.0 – < 14.*, 15.0 – < 15.*, 16.0 – < 16.*, 17.0 – < 17.*, 18.0 – < 18.20.2, 19.0 – < 19.*, 20.0 – < 20.12.2, 21.0 – < 21.7.3 | 4.* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | nodejs20 | 20.15.1-150600.3.3.2 | SUSE-SU-2024:2574-1 |
| SLES 15 SP5 | nodejs18 | 18.20.4-150400.9.24.2 | SUSE-SU-2024:2542-1 |
| SLES 15 SP5 | nodejs20 | 20.15.1-150500.11.12.2 | SUSE-SU-2024:2543-1 |
| SLES 12 | nodejs18 | 18.20.4-8.24.1 | SUSE-SU-2024:2496-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nodejs20 | 20.15.1-1.1 | openSUSE-SU-2024:14214-1 |
| openSUSE Tumbleweed | nodejs21 | 21.7.3-1.1 | openSUSE-SU-2024:14025-1 |
| openSUSE Leap 15.6 | nodejs20 | 20.15.1-150600.3.3.2 | SUSE-SU-2024:2574-1 |
| openSUSE Leap 15.5 | nodejs18 | 18.20.4-150400.9.24.2 | SUSE-SU-2024:2542-1 |
| openSUSE Leap 15.5 | nodejs20 | 20.15.1-150500.11.12.2 | SUSE-SU-2024:2543-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | nodejs-16 | 16.20.2-r16 | — |
| Wolfi rolling | nodejs-18 | 18.20.2-r0 | — |
| Wolfi rolling | nodejs-20 | 20.12.2-r0 | — |
| Wolfi rolling | nodejs-21 | 21.7.3-r0 | — |
Advisories 10
- SUSE-SU-2024:2542-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2496-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14025-1 corepack21-21.7.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2574-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2543-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14214-1 corepack20-20.15.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0847 Node.js: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jan 12, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
References
- http://www.openwall.com/lists/oss-security/2024/04/10/15
- http://www.openwall.com/lists/oss-security/2024/07/11/6
- http://www.openwall.com/lists/oss-security/2024/07/19/3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MZN6PFXHTCCUENAKZXTGWPKUAHI6E2W/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUWBYDVCUSCX7YWTBX75LADMCVYFBGKU/