● Node.js Advisory · April 2026

Node.js Security Advisory: April 2026 Windows Batch Injection Triage

Technical triage of Node.js April 2026 emergency update fixing critical command argument injection on Windows systems.

5
CVEs Patched
1
Critical Remote Code Execution
8.8
CVSS BatBadBut
Critical
Windows Fleet Urgency

Анализ рисков и вердикт безопасности

Node.js issued emergency updates for CVE-2024-27980 (BatBadBut). On Windows, calling child_process.spawn() with .bat or .cmd files implicitly invoked cmd.exe without escaping quotes, allowing arbitrary code execution.

Матрица приоритизации уязвимостей

Идентификатор CVE Подсистема / Компонент Последствия CVSS Активная эксплуатация?
CVE-2024-27980child_process SubsystemWindows Command Injection8.8 HighYES (In-The-Wild)
CVE-2024-27981OpenSSL QuicMemory Leak6.1 MediumNo
CVE-2024-27982dns.lookupDNS Rebinding5.3 MediumNo
РАЗБОР ИСХОДНОГО КОДА

Deep Dive: Node.js Windows Batch Argument Injection (BatBadBut) Teardown →

Examine the JavaScript spawn wrapper in lib/child_process.js escaping batch arguments before passing them to CreateProcessW.

← Полный каталог уязвимостей Все бюллетени безопасности →