CVE-2024-36138 Command injection in Node
Attackers can execute arbitrary commands via malicious arguments in Node.js child_process.spawn on Windows, bypassing previous security fixes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36138?
CVE-2024-36138 is a high-severity command injection vulnerability in NodeJS Node, published on 7 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Weakness: CWE-77
Which versions are affected by CVE-2024-36138?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 18.20.4, 20.15.1, 22.4.1 |
node-min Bitnami | All versions | 18.20.5, 20.18.1, 22.12.0 |
How do I fix CVE-2024-36138?
Upgrade node to a fixed version for your release line: 18.20.4, 20.15.1 or 22.4.1.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-36138 being exploited?
There is no known exploitation of CVE-2024-36138 in the wild and no public exploit code.
Sources
Also known as BIT-node-2024-36138, BIT-node-min-2024-36138, CLEANSTART-2026-FU20845, GHSA-p2ww-p57h-w5m7.