node-js security cve-2024-27980 windows breaking-change

Node.js patches Windows spawn command injection flaw

CVE-2024-27980 forces breaking change: child_process.spawn now errors on .bat/.cmd files without explicit shell option on Windows, requires sanitized input or shell:true flag.

Summary

Windows developers using spawn/spawnSync to execute batch files will see EINVAL errors after patching unless they add shell:true or sanitize arguments. This is a mandatory upgrade blocking production deployments.

Why it matters

Implementation verdict

Replaces unsafe implicit shell invocation with explicit opt-in. Requires: audit spawn calls targeting .bat/.cmd files, add {shell:true} where safe, or sanitize command input. Must upgrade 18.x/20.x/21.x immediately—HIGH severity affects all active lines.

Sources

1.malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled
2.Node.js will now error with EINVAL if a .bat or .cmd file is passed to child_process.spawn and child_process.spawnSync without the shell option set
3.This vulnerability affects all Windows users in active release lines: 18.x, 20.x, 21.x

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs