Security Advisory

CVE-2024-27980

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-01-09 00:33:47

Last updated 2025-04-30 22:25:25

Assigner hackerone

CVSS score 8.1

State PUBLISHED

Description

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

← Browse all CVEs View on cve.org ↗