---
date: 2024-04-10T00:00:00.000Z
category: vulnerability
title: Wednesday, April 10, 2024 Security Releases
slug: april-2024-security-releases-2
layout: blog-post
author: Rafael Gonzaga
---

## Security releases available

Updates are now available for the 18.x, 20.x, 21.x Node.js release lines for the
following issues.

## Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) - (HIGH)

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

It is important to note that there has been a breaking change for Windows users who utilize `child_process.spawn` and `child_process.spawnSync`.
Node.js will now error with `EINVAL` if a `.bat` or `.cmd` file is passed to `child_process.spawn` and `child_process.spawnSync` without the `shell` option set.
If the input to `spawn`/`spawnSync` is sanitized, users can now pass `{ shell: true }` as an option to prevent the occurrence of EINVALs errors.

While it is possible to also pass `--security-revert=CVE-2024-27980` to revert the security patch, we strongly advise against doing so.
Impact:

- This vulnerability affects all Windows users in active release lines: 18.x, 20.x, 21.x

Thank you, to ryotak for reporting this vulnerability and thank you Ben Noordhuis for fixing it.

---

# Summary

The Node.js project will release new versions of the 18.x, 20.x, 21.x
releases lines on or shortly after, Tuesday, April 9, 2024 in order to address:

- 1 high severity issues.

## Impact

The 18.x release line of Node.js is vulnerable to 1 high severity issue.
The 20.x release line of Node.js is vulnerable to 1 high severity issue.
The 21.x release line of Node.js is vulnerable to 1 high severity issue.

## Release timing

Releases will be available on, or shortly after, Tuesday, April 9, 2024.

## Contact and future updates

The current Node.js security policy can be found at https://nodejs.org/en/security/.
Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization.
