{"schema_version":"1","view":"events","data":[{"id":24063,"advisory_id":"d8b49581-c9c4-4768-a348-bee0d6c5c2d6","group_id":"advisory:d8b49581-c9c4-4768-a348-bee0d6c5c2d6","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.20.2","source_published_at":"2024-04-10T16:36:35+00:00","published_at":"2026-10-25T06:29:21.591371+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27980"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.20.2 (LTS) security release","summary":"Node.js 18.20.2 fixes a command injection vulnerability involving child_process.spawn on Windows when the shell option is disabled.","evidence":"This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.20.2 (LTS)"},"prerequisites":[{"value":"without shell option enabled on Windows","evidence":"CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows"}],"fixed_versions":[{"value":"18.20.2","evidence":"Version 18.20.2 'Hydrogen' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27980","evidence":"CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/24063"},{"id":23969,"advisory_id":"0eb20e32-72e2-40eb-a86f-23e8f90d9fda","group_id":"advisory:0eb20e32-72e2-40eb-a86f-23e8f90d9fda","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.12.2","source_published_at":"2024-04-10T16:38:15+00:00","published_at":"2026-10-25T06:27:22.128417+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27980"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.12.2 (LTS)","summary":"This security release addresses command injection on Windows through the args parameter of child_process.spawn when the shell option is disabled.","evidence":"This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.12.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"20.12.2","evidence":"Version 20.12.2 'Iron' (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27980","evidence":"CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/23969"},{"id":23968,"advisory_id":"9b8ebd0c-8c94-4d74-9bf2-b9caee5194d0","group_id":"advisory:9b8ebd0c-8c94-4d74-9bf2-b9caee5194d0","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v21.7.3","source_published_at":"2024-04-10T16:38:50+00:00","published_at":"2026-10-25T06:27:19.027102+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-27980"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 21.7.3 (Current)","summary":"Node.js 21.7.3 is a security release addressing command injection through the child_process.spawn args parameter on Windows when the shell option is disabled.","evidence":"This is a security release. Notable Changes CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows","products":[{"name":{"value":"Node.js","evidence":"Node.js 21.7.3 (Current)"},"prerequisites":[{"value":"without shell option enabled on Windows","evidence":"without shell option enabled on Windows"}],"fixed_versions":[{"value":"21.7.3","evidence":"Version 21.7.3 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27980","evidence":"CVE-2024-27980 - Command injection via args parameter of child_process.spawn"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/23968"},{"id":23139,"advisory_id":"b6e64f8b-6b33-4097-a173-1ddbdfd3a3b1","group_id":"advisory:b6e64f8b-6b33-4097-a173-1ddbdfd3a3b1","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/july-2024-security-releases","source_published_at":"2024-07-08T03:00:00+00:00","published_at":"2026-10-25T06:13:27.214545+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2024-22018","CVE-2024-22020","CVE-2024-27980","CVE-2024-36137","CVE-2024-36138","CVE-2024-37372"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js Security Releases","summary":"Node.js security updates address five vulnerabilities across the 22.x, 20.x, and 18.x release lines. Downloads listed are Node.js v18.20.4, v20.15.1, and v22.4.1.","evidence":"Security releases available Updates are now available for the 22.x, 20.x, 18.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v18.20.4"},"prerequisites":[],"fixed_versions":[{"value":"Node.js v18.20.4","evidence":"Node.js v18.20.4"},{"value":"Node.js v20.15.1","evidence":"Node.js v20.15.1"},{"value":"Node.js v22.4.1","evidence":"Node.js v22.4.1"}],"affected_versions":[{"value":"22.x","evidence":"Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x"},{"value":"20.x","evidence":"Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x"},{"value":"18.x","evidence":"Impact: This vulnerability affects all Windows users in active release lines: 22.x, 20.x, 18.x"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2024-27980","evidence":"Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)"},{"value":"CVE-2024-36138","evidence":"Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138)"},{"value":"CVE-2024-22020","evidence":"Bypass network import restriction via data URL (CVE-2024-22020)"},{"value":"CVE-2024-36137","evidence":"fs.fchown/fchmod bypasses permission model (CVE-2024-36137)"},{"value":"CVE-2024-22018","evidence":"fs.lstat bypasses permission model (CVE-2024-22018)"},{"value":"CVE-2024-37372","evidence":"Permission model improperly processes UNC paths (CVE-2024-37372)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/23139"}],"next_after":24063,"next_before":23139}