Spawning some commands on windows fails with error EINVAL in Node 20 LTS (20.12.2) only

[RobertSandiford]

Version

v20.12.2

Platform

Microsoft Windows NT 10.0.19045.0 x64

Subsystem

child_process

What steps will reproduce the bug?

node -e "const { spawn } = require('child_process'); const child = spawn('npm.cmd', ['--version'], { stdio: 'inherit' })"

How often does it reproduce? Is there a required condition?

100%

What is the expected behavior? Why is that the expected behavior?

Should print the npm version e.g. 10.2.0 to the console

What do you see instead?

node:internal/child_process:421
    throw new ErrnoException(err, 'spawn');
    ^

Error: spawn EINVAL
    at ChildProcess.spawn (node:internal/child_process:421:11)
    at spawn (node:child_process:761:9)
    at [eval]:1:59
    at runScriptInThisContext (node:internal/vm:209:10)
    at node:internal/process/execution:109:14
    at [eval]-wrapper:6:24
    at runScript (node:internal/process/execution:92:62)
    at evalScript (node:internal/process/execution:123:10)
    at node:internal/main/eval_string:51:3 {
  errno: -4071,
  code: 'EINVAL',
  syscall: 'spawn'
}

Node.js v20.12.2

Additional information

Tested and working in 20.12.1 (prior version).

I am able to run spawn('node', ['--version'], { stdio: 'inherit' }) without issue. But running node does not require the .cmd extension and errors with with it (ENOENT) in all tested version.

This appears to be an issue spawning commands that require the .cmd extension, I believe this is a windows only issue.

I tested also with pnpm.cmd and the behaviour is the same as with npm.cmd

[climba03003]

It is intended behavior for the security patch CVE-2024-27980.
You must pass shell: true in the option on Windows environment if you need to spawn program ended with .bat or .cmd extension.

The patch is deployed in 18.20.2, 20.12.2, 21.17.3 and also 22.0.0
Details can be found on https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

[RobertSandiford]

It is intended behavior for the security patch CVE-2024-27980. You must pass shell: true in the option on Windows environment if you need to spawn program ended with .bat or .cmd extension.

The patch is deployed in 18.20.2, 20.12.2, 21.17.3 and also 22.0.0 Details can be found on https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

Thanks.

The error message produced is disappointing - I could not find information on google.

[juanarbol]

I'll proceed to close this issue as it is resolved in windows by providing the {shell: true} option as documented in the release