Spawning some commands on windows fails with error EINVAL in Node 20 LTS (20.12.2) only

[RobertSandiford]

Version

v20.12.2

Platform

Microsoft Windows NT 10.0.19045.0 x64

Subsystem

child_process

What steps will reproduce the bug?

node -e "const { spawn } = require('child_process'); const child = spawn('npm.cmd', ['--version'], { stdio: 'inherit' })"

How often does it reproduce? Is there a required condition?

100%

What is the expected behavior? Why is that the expected behavior?

Should print the npm version e.g. 10.2.0 to the console

What do you see instead?

node:internal/child_process:421
    throw new ErrnoException(err, 'spawn');
    ^

Error: spawn EINVAL
    at ChildProcess.spawn (node:internal/child_process:421:11)
    at spawn (node:child_process:761:9)
    at [eval]:1:59
    at runScriptInThisContext (node:internal/vm:209:10)
    at node:internal/process/execution:109:14
    at [eval]-wrapper:6:24
    at runScript (node:internal/process/execution:92:62)
    at evalScript (node:internal/process/execution:123:10)
    at node:internal/main/eval_string:51:3 {
  errno: -4071,
  code: 'EINVAL',
  syscall: 'spawn'
}

Node.js v20.12.2

Additional information

Tested and working in 20.12.1 (prior version).

I am able to run spawn('node', ['--version'], { stdio: 'inherit' }) without issue. But running node does not require the .cmd extension and errors with with it (ENOENT) in all tested version.

This appears to be an issue spawning commands that require the .cmd extension, I believe this is a windows only issue.

I tested also with pnpm.cmd and the behaviour is the same as with npm.cmd

[climba03003]

It is intended behavior for the security patch CVE-2024-27980.
You must pass shell: true in the option on Windows environment if you need to spawn program ended with .bat or .cmd extension.

The patch is deployed in 18.20.2, 20.12.2, 21.17.3 and also 22.0.0
Details can be found on https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

[RobertSandiford]

It is intended behavior for the security patch CVE-2024-27980. You must pass shell: true in the option on Windows environment if you need to spawn program ended with .bat or .cmd extension.

The patch is deployed in 18.20.2, 20.12.2, 21.17.3 and also 22.0.0 Details can be found on https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

Thanks.

The error message produced is disappointing - I could not find information on google.

[juanarbol]

I'll proceed to close this issue as it is resolved in windows by providing the {shell: true} option as documented in the release

[cliffAtOsaic]

The documentation states "users can now pass { shell: true } as an option to prevent the occurrence of EINVALs errors".

My question is what process do I pass that to and how do I pass that parameter?

I tried yarn config set shell true but that didn't fix the error.

I see this error when I execute yarn yarn-audit-fix or npx yarn-audit-fix

[RobertSandiford]

The documentation states "users can now pass { shell: true } as an option to prevent the occurrence of EINVALs errors".

My question is what process do I pass that to and how do I pass that parameter?

I tried yarn config set shell true but that didn't fix the error.

I see this error when I execute yarn yarn-audit-fix or npx yarn-audit-fix

Example: spawn('npm.cmd', ['--version'], { shell: true, stdio: 'inherit' }

[cliffAtOsaic]

The documentation states "users can now pass { shell: true } as an option to prevent the occurrence of EINVALs errors".
My question is what process do I pass that to and how do I pass that parameter?
I tried yarn config set shell true but that didn't fix the error.
I see this error when I execute yarn yarn-audit-fix or npx yarn-audit-fix

Example: spawn('npm.cmd', ['--version'], { shell: true, stdio: 'inherit' }

I'm running yarn yarn-audit-fix or npx yarn-audit-fix and getting this error. How do I pass the { shell: true } parameter through npx or yarn?

Also tried running npx yarn-audit-fix --security-revert=CVE-2024-27980 which didn't work either.

[RobertSandiford]

I'm running yarn yarn-audit-fix or npx yarn-audit-fix and getting this error. How do I pass the { shell: true } parameter through npx or yarn?

You can't, it's part of the code. Check for updates, or create an issue on the npx/yarn issue tracker.

Note that this may not be on ONLY cause of an EINVAL error, it's a fairly general error.

[BrunoCiccarino]

É o comportamento pretendido para o patch de segurança CVE-2024-27980. Você deve passar shell: truena opção no ambiente Windows se precisar spawnprogramar terminado com .batou .cmdextensão.

O patch foi implantado em 18.20.2, 20.12.2, 21.17.3e também 22.0.0 Detalhes podem ser encontrados em https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

I don't understand, where do I pass shell: true? I'm having the same error and I'm lost...

[vochitan90]

same question - i still see the error spawn EINVAL

[RobertSandiford]

I don't understand, where do I pass shell: true? I'm having the same error and I'm lost...

same question - i still see the error spawn EINVAL

This has been answered already:

Example: spawn('npm.cmd', ['--version'], { shell: true, stdio: 'inherit' }

As seen in the docs for the spawn comment from the child_process built in module https://nodejs.org/api/child_process.html#child_processspawncommand-args-options

This flag must be set in the code that is calling spawn(). If you are using a library or package that uses spawn incorrectly, you cannot pass some flag to node globally, this is a flag on the function call itself within the code.

[deepak-aupchaarik]

Yeah it's not clear where to pass this parameter for this specific scenario. I run into this while installing an npm package. The spawn error occurs after node build.js is executed. You want me to edit the build.js file? I don't even see that in the node folder. Should I do npm install --shell true? An example would help. I don't own the code calling spawn()

[RobertSandiford]

Yeah it's not clear where to pass this parameter for this specific scenario. I run into this while installing an npm package. The spawn error occurs after node build.js is executed. You want me to edit the build.js file? I don't even see that in the node folder. Should I do npm install --shell true? An example would help. I don't own the code calling spawn()

Examples have been given. You edit the spawn call if it is your code, or if someone else maintains the code you ask them to update it. If you don't know where your code is or who maintains it.

The patch can be disabled globally by passing --security-revert=CVE-2024-27980 to node, but doing so is strongly advised against.

[richardlau]

Node offers no general override to restore the pre-patch behaviour. Unfortunately yes the patch breaks semver.

https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

While it is possible to also pass --security-revert=CVE-2024-27980 to revert the security patch, we strongly advise against doing so.

[RobertSandiford]

Node offers no general override to restore the pre-patch behaviour. Unfortunately yes the patch breaks semver.

https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

While it is possible to also pass --security-revert=CVE-2024-27980 to revert the security patch, we strongly advise against doing so.

My bad. Thanks. Editing the above to avoid incorrect information.

[mshahzadiftikhar]

What is the complete command to revert this security patch from the installation? I am on windows. Looks like
node --security-revert=CVE-2024-27980 is just a CLI option. For me this error occurs when I run yarn install or npm install

[Adityav664]

It is intended behavior for the security patch CVE-2024-27980. You must pass shell: true in the option on Windows environment if you need to spawn program ended with .bat or .cmd extension.

The patch is deployed in 18.20.2, 20.12.2, 21.17.3 and also 22.0.0 Details can be found on https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

shell: TRUE
TRUE' is deprecated.ts(6385)
function.d.ts(192, 4): The declaration was marked as deprecated here.
(alias) const TRUE: types.Boolean
import TRUE
A shorthand for sass.types.Boolean.TRUE.

@category — Legacy

@deprecated — This only works with the legacy render and * renderSync APIs. Use sassTrue with compile , * compileString, compileAsync , and compileStringAsync instead.

[Adityav664]

I'll proceed to close this issue as it is resolved in windows by providing the {shell: true} option as documented in the release

shell: True is deprecated,
what now?