Skip to content

Commit cf985e3

Browse files
vuln: update core index.json (#1523)
Co-authored-by: Create or Update Pull Request Action <[email protected]>
1 parent 9d595a8 commit cf985e3

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

vuln/core/index.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1887,12 +1887,13 @@
18871887
],
18881888
"vulnerable": "18.x || 20.x || 21.x",
18891889
"patched": "^18.20.2 || ^20.12.2 || ^21.7.3",
1890-
"ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2/",
1890+
"ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2",
1891+
"description": "Command injection via args parameter of child_process.spawn without shell option enabled on Windows",
18911892
"overview": "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.",
18921893
"affectedEnvironments": [
18931894
"win32"
18941895
],
1895-
"severity": "medium"
1896+
"severity": "high"
18961897
},
18971898
"142": {
18981899
"cve": [

0 commit comments

Comments
 (0)