CVE-2024-3566
published 2024-04-10CVE-2024-3566: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
6.88%
93.3th percentile
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | — | — |
| go_programming_language | golang | — | — |
| haskell | process_library | < 1.6.19.0 | 1.6.19.0 |
| haskell_programming_language | haskel | — | — |
| node.js | node.js | * – 21.7.2 | — |
| nodejs | node.js | < 18.20.2 | 18.20.2 |
| nodejs | node.js | >= 19.0.0 < 20.12.2 | 20.12.2 |
| nodejs | node.js | >= 21.0.0 < 21.7.3 | 21.7.3 |
| php | php | < 8.1.28 | 8.1.28 |
| php | php | >= 8.2.0 < 8.2.18 | 8.2.18 |
| php | php | >= 8.3.0 < 8.3.6 | 8.3.6 |
| rust-lang | rust | < 1.77.2 | 1.77.2 |
| symfony | process | >= 1.0.0.0 < 1.6.23.0 | 1.6.23.0 |
| yt-dlp_project | yt-dlp | >= 2021.04.11 < 2024.04.09 | 2024.04.09 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_debian9.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Node.js up to 18.20.1/20.12.1/21.7.2 on Windows CreateProcess os command injection (VU#123335)
vuldb·2026-05-17·CVSS 9.8
CVE-2024-3566 [CRITICAL] Node.js up to 18.20.1/20.12.1/21.7.2 on Windows CreateProcess os command injection (VU#123335)
A vulnerability classified as critical has been found in Node.js up to 18.20.1/20.12.1/21.7.2 on Windows. The affected element is the function CreateProcess. The manipulation leads to os command injection.
This vulnerability is traded as CVE-2024-3566. Access to the local network is required for this attack to succeed. There is no exploit available.
It is recommended to upgrade the affected component.
OSV
process: command injection via argument list on Windows
osv·2025-11-14
CVE-2024-3566 process: command injection via argument list on Windows
process: command injection via argument list on Windows
# process: command injection via argument list on Windows
The *process* library on Windows is vulnerable to a command injection
vulnerability, via `cmd.exe`'s interpretation of arguments. Programs that
invoke batch files (`.bat`, `.cmd`) and pass arguments whose values are
affected by program inputs may be affected.
This issue was discovered in many programming languages' Windows process
execution behaviour. It was tracked by CERT/CC as **VU#123335** and a
coordinated disclosure was made on 2024-04-09 17:00 UTC.
A fix was released in *process-1.6.19.0*.
## Background
Unlike POSIX systems, Windows does not have a mechanism for passing multiple
arguments.Command line parsing is up to individual programs.
The *process* library de
GHSA
GHSA-9xch-xvj3-fmf3: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fun
ghsa_unreviewed·2024-04-10
CVE-2024-3566 [CRITICAL] CWE-77 GHSA-9xch-xvj3-fmf3: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fun
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Debian
CVE-2024-3566: nodejs - A command inject vulnerability allows an attacker to perform command injection o...
vendor_debian·2024·CVSS 9.8
CVE-2024-3566 [CRITICAL] CVE-2024-3566: nodejs - A command inject vulnerability allows an attacker to perform command injection o...
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/https://kb.cert.org/vuls/id/123335https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-wayhttps://www.cve.org/CVERecord?id=CVE-2024-1874https://www.cve.org/CVERecord?id=CVE-2024-22423https://www.cve.org/CVERecord?id=CVE-2024-24576https://www.kb.cert.org/vuls/id/123335https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566https://kb.cert.org/vuls/id/123335https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-wayhttps://www.cve.org/CVERecord?id=CVE-2024-1874https://www.cve.org/CVERecord?id=CVE-2024-22423https://www.cve.org/CVERecord?id=CVE-2024-24576https://www.kb.cert.org/vuls/id/123335
2024-04-10
Published