CVE-2024-27980 — Node.js Windows command injection via child_process

On Windows, Node.js's child_process.spawn with shell:false still invoked cmd.exe for .bat and .cmd files, allowing argument-injection attacks.