CVE Feed

    Dashboard / CVE / CVE-2024-3566

    CVE-2024-3566

    A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

    Published:Apr 10, 2024
    Last Modified:May 15, 2026
    EPS:Apr 10, 2024
    EPSS Score:0.0709
    CVSS Score:9.8

    Affected Products

    Vendor
    Haskell
    Product
    Process Library
    Vendor
    Microsoft
    Product
    Windows
    Vendor
    Nodejs
    Product
    Node.js
    Vendor
    Nodejs
    Product
    Nodejs
    Vendor
    Php
    Product
    Php
    Vendor
    Rust-lang
    Product
    Rust
    Vendor
    Thephpgroup
    Product
    Thephpgroup
    Vendor
    Yt-dlp Project
    Product
    Yt-dlp

    Exploits

    https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/

    References

    https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
    https://kb.cert.org/vuls/id/123335
    https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
    https://www.cve.org/CVERecord?id=CVE-2024-1874
    https://www.cve.org/CVERecord?id=CVE-2024-22423
    https://www.cve.org/CVERecord?id=CVE-2024-24576
    https://www.kb.cert.org/vuls/id/123335
    https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
    https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566
    https://kb.cert.org/vuls/id/123335
    https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
    https://www.cve.org/CVERecord?id=CVE-2024-1874
    https://www.cve.org/CVERecord?id=CVE-2024-22423
    https://www.cve.org/CVERecord?id=CVE-2024-24576
    https://www.kb.cert.org/vuls/id/123335

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High