cve/2024/CVE-2024-27980.md

CVE-2024-27980

Description

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

POC

Reference

No PoCs from references.

Github

• https://github.com/Cybervixy/Vulnerability-Management
• https://github.com/Oju-kwu/Vulnerability-Management-Lab
• https://github.com/Oluwaseun-Joseph/Credentialed-Vulnerability-Assessment-Lab
• https://github.com/Teedico/Nessus_Vulnerability_Assessment
• https://github.com/ardhi/get-global-path
• https://github.com/tanjiti/sec_profile
• https://github.com/tianstcht/tianstcht