UnratedFix available
Node.js 18.20.2 (LTS) security release
Node.js 18.20.2 fixes a command injection vulnerability involving child_process.spawn on Windows when the shell option is disabled.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Node.js
Node.js 18.20.2 (LTS)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 18.20.2
Version 18.20.2 'Hydrogen' (LTS)
- Prerequisites
- without shell option enabled on Windows
CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
- Related CVEs
- CVE-2024-27980
CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Publisher severity
No explicit severity was extracted.
- Event
- #24063 · Revision 1
- Added to Heist Feed
- Publisher date