cve/2024/CVE-2024-27980.md

### [CVE-2024-27980](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27980)
![](https://img.shields.io/static/v1?label=Product&message=Node&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=10.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=11.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=12.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=13.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=14.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=15.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=16.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=17.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=18.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=19.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=20.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=21.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=4.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=5.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=7.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cve-scores
- https://github.com/Cybervixy/Vulnerability-Management
- https://github.com/Oju-kwu/Vulnerability-Management-Lab
- https://github.com/Oluwaseun-Joseph/Credentialed-Vulnerability-Assessment-Lab
- https://github.com/Teedico/Nessus_Vulnerability_Assessment
- https://github.com/ardhi/get-global-path
- https://github.com/sharmapintu987654321-boop/Nessus-Scan-Reports
- https://github.com/tanjiti/sec_profile
- https://github.com/tianstcht/tianstcht