Aikido Intel
Secure My Code
Intel

AIKIDO-2024-10026

node is vulnerable to Command injection

Command injectionCVE-2024-27980 Published Apr 12, 2024

80

High Risk

This Affects:

osnode
18.0.0 - 18.20.1
Fixed in 18.20.2
20.0.0 - 20.12.1
Fixed in 20.12.2
21.0.0 - 21.7.2
Fixed in 21.7.3
Are you affected? Scan for Free

TL;DR

Due to improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution, even if the shell option is not enabled.

Who does this affect?

This vulnerability affects all users in active release lines: 18.x, 20.x, 21.x but it is only exploitable on Windows.

Background info

node is vulnerable to Command injection in versions 21.0.0 - 21.7.2, 20.0.0 - 20.12.1 and 18.0.0 - 18.20.1.

How to fix this

Upgrade the node library to a patch version.

Links

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Scan for Free
Book a Demo

Free. No credit card required.

Aikido Platform
Subscribe
Stay up to date with all updates
LinkedIn YouTube X
© 2026 Aikido Security BV | BE0792914919
Ghent, Belgium | San Francisco, US
SOC 2SOC 2Compliant
ISO 27001ISO 27001Compliant
Get Security Done