Node.js Windows batch injection

Summary

A malicious command-line argument can inject commands through child_process.spawn or spawnSync on Windows, even when the shell option is not enabled.

Component: Node.js core on Windows. Disclosed: 10 April 2024. Last verified: 22 October 2026, 16:45 UTC.

Affected versions

Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. Node.js Project NIST NVD

Fixed versions

Fixed in 18.20.2, 20.12.2 and 21.7.3. The fix makes spawn/spawnSync return EINVAL for .bat/.cmd without shell:true. Node.js Project NIST NVD

Conditions and scope

These are the conditions named by the sources. They are not a score and not a prediction.

• Windows host.
• Application passes attacker-influenced arguments to child_process.spawn or spawnSync.
• A .bat or .cmd file is involved, per the official advisory.

Exploitation status

No public confirmation of exploitation was found in the sources checked. This is not proof it was never exploited.

Severity and scoring

Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.

Mechanism

Node.js's Windows implementation of spawn and spawnSync handles batch files through cmd.exe. The advisory says improper handling allows a malicious command-line argument to inject commands even when the shell option is not enabled.

The fix deliberately changes behaviour. Code that legitimately runs .bat or .cmd files must pass shell:true, and only after sanitising the arguments. Treating the new EINVAL as a regression and reverting the security patch would reintroduce the flaw.

Scope

Linux and macOS deployments are not described as affected by this CVE. The condition is Windows plus attacker-influenced arguments. Applications that never spawn batch files are outside the described path.

This is Node.js core, not an npm package. The distinction matters when writing an inventory: a package scanner will not fix the runtime.

What to do

• Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
• Interim controls and their limits — how to buy time without claiming a fix.
• Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.

Sources

Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.