Improper Control of Generation of Code ('Code Injection')

🗓️ 09 Jul 2024 09:39:36Reported by Snyk Security DatabaseType

Code injection via command line on Windows with child_process.spawn or spawnSync; upgrade to version 20.16.0 or higher.

Reporter	Title	Published	Views	Family All 77
IBM Security Bulletins	Security Bulletin: A vulnerability in Node.js affects IBM Rational® Application Developer for WebSphere® Software (CVE-2024-36138)	19 Aug 202416:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js affect IBM Business Automation Workflow	9 Oct 202413:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Controller is affected by vulnerabilities	15 Apr 202502:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js.	13 Dec 202420:12	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Node.js affects IBM Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition (CVE-2024-36138)	23 Sep 202420:51	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control	17 Sep 202408:40	–	ibm
AlpineLinux	CVE-2024-36138	7 Sep 202416:00	–	alpinelinux
BDU FSTEC	The vulnerability of the Node.js software platform, related to errors in processing input data, allows a hacker to execute arbitrary commands.	9 Jul 202400:00	–	bdu_fstec
Broadcom	Oracle Java SE Multiple Vulnerabilities (October 2024)	8 Jul 202500:00	–	broadcom
Broadcom	Azul Zulu Java Multiple Vulnerabilities (October 2024)	8 Jul 202500:00	–	broadcom

Vulners

Node

nodejs nodejsRange<20.16.0

Source	Link
cwe	www.cwe.mitre.org/data/definitions/CWE-78.html
security	www.security.snyk.io/vuln/SNYK-CONAN-NODEJS-10669666

15 Sep 2024 23:14Current

8.1High risk

Vulners AI Score8.1

CVSS 46.9

CVSS 3.17.2

CVSS 38.1

EPSS0.01098

SSVC