CVE-2024-36138

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-07 · updated 2026-06-17
Weakness: CWE-77

Description

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Affected products

nodejs: from 18.0 before 18.20.4; from 20.0 before 20.15.1; from 22.0 before 22.4.1 — fixed in 18.20.4, 20.15.1, 22.4.1

How to fix

Upgrade to a fixed version: nodejs 18.20.4, 20.15.1, 22.4.1. Check the vendor advisory for mitigations.

References

https://nodejs.org/en/blog/vulnerability/july-2024-security-releases
https://security.netapp.com/advisory/ntap-20241108-0010/

Get alerted when CVE-2024-36138 or the next vulnerability affects your stack