{"id":7284,"date":"2024-04-21T15:58:22","date_gmt":"2024-04-21T07:58:22","guid":{"rendered":"https:\/\/i007.vip:15443\/wordpress\/?p=7284"},"modified":"2024-04-21T15:58:22","modified_gmt":"2024-04-21T07:58:22","slug":"wednesday-april-10-2024-security-releases","status":"publish","type":"post","link":"https:\/\/i007.cc\/wordpress\/archives\/7284","title":{"rendered":"Wednesday, April 10, 2024 Security Releases"},"content":{"rendered":"

cc from<\/a><\/p>\n

\n

\n<\/section>\n

\n
Wednesday, April 10, 2024 Security Releases<\/div>\n<\/div>\n

Security releases available<\/a><\/h2>\n

Updates are now available for the 18.x, 20.x, 21.x Node.js release lines for the following issues.<\/p>\n

Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) – (HIGH)<\/a><\/h2>\n

Due to the improper handling of batch files in child_process.spawn \/ child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.<\/p>\n

It is important to note that there has been a breaking change for Windows users who utilize\u00a0child_process.spawn<\/code>\u00a0and\u00a0child_process.spawnSync<\/code>. Node.js will now error with\u00a0EINVAL<\/code>\u00a0if a\u00a0.bat<\/code>\u00a0or\u00a0.cmd<\/code>\u00a0file is passed to\u00a0child_process.spawn<\/code>\u00a0and\u00a0child_process.spawnSync<\/code>\u00a0without the\u00a0shell<\/code>\u00a0option set. If the input to\u00a0spawn<\/code>\/spawnSync<\/code>\u00a0is sanitized, users can now pass\u00a0{ shell: true }<\/code>\u00a0as an option to prevent the occurrence of EINVALs errors.<\/p>\n

While it is possible to also pass\u00a0--security-revert=CVE-2024-27980<\/code>\u00a0to revert the security patch, we strongly advise against doing so. Impact:<\/p>\n