CVE-2024-36138: Command Injection
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via childprocess.spawn / childprocess.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
Other sources
Node.js could allow a remote attacker to execute arbitrary commands on the system, caused by the incomplete fix of CVE-2024-27980 which was the improper handling of batch files in childprocess.spawn / childprocess.spawnSync. By sending a specially crafted command line argument, an attacker could exploit this vulnerability to inject and execute arbitrary commands on the system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36138?
CVE-2024-36138 is classified as a high-severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2024-36138?
To mitigate CVE-2024-36138, update to IBM Planning Analytics versions beyond 2.1 or 2.0, which contain the patched code.
What software is affected by CVE-2024-36138?
CVE-2024-36138 affects IBM Planning Analytics versions 2.1 and 2.0.
What type of vulnerability is CVE-2024-36138?
CVE-2024-36138 is a command injection vulnerability that allows attackers to execute arbitrary commands.
What was the cause of CVE-2024-36138?
The vulnerability was caused by improper handling of batch files through the child_process.spawn method in Node.js.