All errata/sisyphus/ALT-PU-2024-7199-3
ALT-PU-2024-7199-3

Package update node in branch sisyphus

Version20.12.2-alt1
Task#345946
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (2)

BDU:2024-05853
HIGH8.8

Уязвимость функций child_process.spawn() и child_process.spawnSync() программной платформы Node.js операционных систем Windows, позволяющая нарушителю обойти ограничения безопасности и выполнить произвольные команды

Published: 2024-07-31Modified: 2026-03-04
CVSS 3.xHIGH 8.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
CVE-2024-27980
HIGH8.1

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Published: 2025-01-09Modified: 2026-04-15
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References