CVE-2024-3566

CRITICAL 9.8CVE-2024-3566 · Published 10/04/2024 · updated 17/06/2026

In short

CVE-2024-3566 is a CRITICAL (CVSS 9.8) vulnerability affecting process library (haskell), node.js (nodejs), php (php).
Chance of exploitation in the next 30 days (EPSS): 6.8%, higher than 94.0% of all vulnerabilities.
Fix: update to 1.6.19.0, 20.12.2, 21.7.3, 18.20.2 or later.

Package	Affected versions	Patched versions
process library haskell	`< 1.6.19.0`	`1.6.19.0`
node.js nodejs	`≥ 19.0.0, < 20.12.2≥ 21.0.0, < 21.7.3< 18.20.2`	`20.12.221.7.318.20.2`
php php	`≥ 8.2.0, < 8.2.18≥ 8.3.0, < 8.3.6< 8.1.28`	`8.2.188.3.68.1.28`
rust rust-lang	`< 1.77.2`	`1.77.2`
yt-dlp yt-dlp_project	`≥ 2021.04.11, < 2024.04.09`	`2024.04.09`

Description

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

References

flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows · Exploit
kb.cert.org/vuls/id/123335 · Third Party Advisory
learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way · Technical Description
cve.org/CVERecord · Not Applicable
cve.org/CVERecord · Not Applicable
cve.org/CVERecord · Not Applicable
kb.cert.org/vuls/id/123335 · Not Applicable
nu11secur1ty/Windows11Exploits · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free