CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Affects 7 products across 6 vendors.
Attacker injects operating system commands through application inputs passed to a shell or system call.
Show all 8
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical command injection vulnerability exists in Windows applications that indirectly use the CreateProcess function under specific conditions, allowing attackers to execute arbitrary commands.
BSID: BS-2024-GLOBAL-200887-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-3566?
What is the CVSS score for CVE-2024-3566?
Is CVE-2024-3566 actively exploited?
How do I remediate CVE-2024-3566?
What systems are affected by CVE-2024-3566?
| CVE ID | CVE-2024-3566 |
|---|---|
| BSID | BS-2024-GLOBAL-200887-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2024-04-10 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises when applications improperly sanitize user input before passing it to the CreateProcess function, enabling attackers to inject malicious commands.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Haskell | Process Library | < 1.6.19.0 |
| Nodejs | Node.Js | < 18.20.2 ≥ 19.0.0, < 20.12.2 ≥ 21.0.0, < 21.7.3 |
| Nodejs | Nodejs | ≤ 21.7.2 |
| Php | Php | < 8.1.28 ≥ 8.2.0, < 8.2.18 ≥ 8.3.0, < 8.3.6 |
| Rust-Lang | Rust | < 1.77.2 |
| Yt-Dlp Project | Yt-Dlp | All versions |
Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Microsoft Windows
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | d1eea2285e0e6118760af4ab66fd426331db365bf8e56924f06b80b50b14b48d3d5b43f837653f68e9010a2c65206548464a58265c4d94bb6665d693f8bb0d4a |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →