Which CVE IDs does CVE-2024-36138 cover?

CVE-2024-36138 covers the following CVE IDs: CVE-2024-36138. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2024-36138?

CVE-2024-36138 has a CVSS v3 base score of 8.1, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2024-36138?

CVE-2024-36138 affects 3 products, including: azl3 nodejs 20.14.0-8 on Azure Linux 3.0; cbl2 nodejs18 18.20.3-6; cbl2 nodejs18 18.20.3-6 on CBL-Mariner 2.0.

CVE-2024-36138CriticalCVSS 8.1

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Vendor

Microsoft Security Response Center (MSRC)

Published

August 7, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2024-36138 →

🎯 Affected products3

azl3 nodejs 20.14.0-8 on Azure Linux 3.0
cbl2 nodejs18 18.20.3-6
cbl2 nodejs18 18.20.3-6 on CBL-Mariner 2.0

🔗 References (1)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-36138