VDB

CVE-2024-27980

CVE-2024-27980 PUBLISHED CVSS 9.300000190734863 CRITICAL

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

EPSS 0.37% · 59.1th percentile

Risk Scores

CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.37%
59.1th percentile

Affected Products

VendorProductVersions
Bitnaminode0, 19.0.0, 21.0.0
Bitnaminode-min0, 19.0.0, 21.0.0
Bitnaminode-min0, 21.0.0, 19.0.0
Bitnaminode0, 19.0.0, 21.0.0

Exploit Intelligence

…and 896 more exploits

Timeline

  • Apr 10, 2024 CVE Published
  • Jan 9, 2025 EPSS Score
  • Jan 12, 2025 CVE Updated
  • Jan 25, 2025 EPSS Score
  • Feb 3, 2025 Coalition ESS Score
  • Feb 9, 2025 EPSS Score
  • Mar 13, 2025 EPSS Score
  • Mar 19, 2025 EPSS Score
  • Mar 20, 2025 EPSS Score
  • Mar 27, 2025 EPSS Score
  • Mar 29, 2025 EPSS Score
  • Mar 30, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›