Command injection vulnerability in programing languages on Microsoft Windows operating system.
Priority HIGH 82CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.
Summary
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.06827 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | Node.js | up to 21.7.2 | — | No fix listed | CNA |
| Go Programming Language | GoLang | all versions | — | No fix listed | CNA |
| Haskell Programming Language | Haskel | all versions | — | No fix listed | CNA |
- Node.js VendorNodeJS Affected up to 21.7.2 Fixed in — No fix listed CNA
- GoLang VendorGo Programming Language Affected all versions Fixed in — No fix listed CNA
- Haskel VendorHaskell Programming Language Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:* | before 1.6.19.0 | Vulnerable | Haskell |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | before 18.20.2; 19.0.0 to before 20.12.2; 21.0.0 to before 21.7.3 | Vulnerable | NodeJS |
| cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | before 8.1.28; 8.2.0 to before 8.2.18; 8.3.0 to before 8.3.6 | Vulnerable | PHP |
| cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:* | before 1.77.2 | Vulnerable | rust-lang |
| cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* | 2021.04.11 to before 2024.04.09 | Vulnerable | yt-dlp |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:* Versions before 1.6.19.0 Vulnerable ·Haskell
- cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* Versions before 18.20.2; 19.0.0 to before 20.12.2; 21.0.0 to before 21.7.3 Vulnerable ·NodeJS
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions before 8.1.28; 8.2.0 to before 8.2.18; 8.3.0 to before 8.3.6 Vulnerable ·PHP
- cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:* Versions before 1.77.2 Vulnerable ·rust-lang
- cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* Versions 2021.04.11 to before 2024.04.09 Vulnerable ·yt-dlp
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3566
- 2026-10-03 Alias added: GHSA-9xch-xvj3-fmf3
References
Advisory 2
Other 5
- https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
- https://www.cve.org/CVERecord?id=CVE-2024-24576
- https://www.cve.org/CVERecord?id=CVE-2024-1874
- https://www.cve.org/CVERecord?id=CVE-2024-22423
- https://www.kb.cert.org/vuls/id/123335
More NodeJS Node.js vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
- TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
- TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
Sources
- CVE-2024-3566 · CVE Program
- CVE-2024-3566 · NVD
- FIRST EPSS
- GHSA-9xch-xvj3-fmf3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences