← Back

CVE-2024-3566

nvd nist
Published: Apr 10, 2024Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Affected (9)

Products: Haskell: Process Library · Nodejs: Node.js · Php: Php · +2 more
Show all products
Haskell: Process Library · Nodejs: Node.js · Php: Php · Rust Lang: Rust · Yt Dlp Project: Yt Dlp
Haskell
1 product
Process Library
Nodejs
1 product
Node.js
Php
1 product
Php
Rust Lang
1 product
Rust
Yt Dlp Project
1 product
Yt Dlp
Configuration A
9 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Process Library
version < 1.6.19.0
Nodejs
Node.js
version < 18.20.2
Node.js
19.0.0 ≤ version < 20.12.2
Node.js
21.0.0 ≤ version < 21.7.3
Php
Php
version < 8.1.28
Php
8.2.0 ≤ version < 8.2.18
Php
8.3.0 ≤ version < 8.3.6
Rust
version < 1.77.2
Yt Dlp
2021.04.11 ≤ version < 2024.04.09
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (15)

Source: cret@cert.org
ExploitThird Party Advisory
Source: cret@cert.org
Third Party Advisory
Source: cret@cert.org
Technical Description
Source: cret@cert.org
Not Applicable
Source: cret@cert.org
Not Applicable
Source: cret@cert.org
Not Applicable
Source: cret@cert.org
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Technical Description
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable

Timeline

No history available yet.