What is the CVSS score of CVE-2024-3566?

CVE-2024-3566 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 7.1%.

Is there a public PoC exploit available for CVE-2024-3566?

Yes, a public proof-of-concept exploit is available for CVE-2024-3566. Prioritise patching immediately. EPSS: 7.1%.

How to fix or mitigate CVE-2024-3566?

Within 24 hours: Conduct inventory of Windows systems running Node.js, PHP, Rust, or yt-dlp in production and development environments. Within 7 days: Implement input validation and sanitization for any application spawning child processes; disable batch file execution where operationally feasible; segment network access to vulnerable systems. Within 30 days: Establish monitoring for vendor security advisories; prepare deployment procedures for patches once released; evaluate alternative execution methods that avoid CreateProcess batch file handling.

CreateProcess (Windows) CVE-2024-3566

CRITICAL

Command Injection (CWE-77)

2024-04-10 cret@cert.org

PHP Command Injection Node.js Microsoft Rust Yt Dlp Node Js Process Library Yt Dlp Project Haskell Rust Lang

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Identify Windows app using vulnerable runtime
Delivery

Locate input passed to subprocess call
Exploit

Craft payload with cmd.exe metacharacters
Install

Submit via network request
C2

CreateProcess invokes cmd.exe with injected args
Execute

Arbitrary commands execute under service account
Impact

Establish foothold or pivot

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires that the target application (1) runs on Windows, (2) uses a vulnerable version of Node.js, PHP, Rust, Haskell process library, or yt-dlp to spawn child processes, and (3) passes attacker-controllable data into the argument list of a subprocess call - typically one that invokes a .bat/.cmd file or otherwise triggers implicit cmd.exe dispatch through CreateProcess. Exploitation is limited by the need for the application to actually forward untrusted input to subprocess APIs on Windows; pure Linux/macOS deployments, applications that do not shell out, and applications that already sanitize against cmd.exe metacharacters are not exposed despite running an affected runtime version.
Impact	CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects worst-case downstream exposure: a network-reachable application written in any of these runtimes that forwards untrusted input into a subprocess call on Windows can yield unauthenticated RCE with high CIA impact. EPSS at 7.09% / 92nd percentile and a publicly available POC raise this above background noise, yet absence from CISA KEV suggests exploitation has not been confirmed at scale. The CVSS vector describes the worst-case downstream scenario rather than the API itself - actual exploitability depends entirely on whether a given application passes attacker-controlled data to subprocess APIs on Windows and which runtime version it uses, so blanket prioritization by CVSS alone will over- or under-state risk for any specific deployment.
Exploit ScenarioDerived	A web service running on Windows uses a vulnerable Node.js or PHP version to invoke a helper tool (for example, an image converter or yt-dlp) with a user-supplied filename or URL as an argument. The attacker submits a crafted value containing cmd.exe metacharacters that survives the runtime's argument escaping; CreateProcess hands it to cmd.exe, which interprets the embedded payload as an additional command and executes it under the service account. A public POC exists, lowering the barrier from theoretical to practical.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 7.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PHP, Rust, Haskell process library, yt-dlp) that wrap the API without compensating for its quirks. Remote attackers can smuggle additional commands through arguments passed to child processes when applications spawn batch files or otherwise rely on CreateProcess's implicit cmd.exe handling. Publicly available exploit code exists and EPSS of 7.09% (92nd percentile) signals elevated, though not confirmed in-the-wild, exploitation interest; this CVE is not listed in CISA KEV.

RemediationAI

Upgrade to the patched release for each affected runtime: Node.js, PHP, Rust, the Haskell process library, and yt-dlp each issued coordinated fixes - consult the respective project security advisories linked from the NVD entry for the exact patched version applicable to your branch. Where immediate patching is not possible, compensating controls include refusing to invoke .bat/.cmd files from subprocess APIs (call the underlying executable directly, side-stepping cmd.exe), strictly allow-listing argument characters before passing them to spawn/exec functions, or running Windows workloads on alternative shells via explicit cmd.exe invocation with manual escaping - note that disallowing batch files may break legitimate workflows that depend on .bat wrappers, and character allow-listing risks rejecting valid input such as filenames with spaces or special characters.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw (CWE-77, Improper Neutralization of Special Elements used in a Command) stems from how Windows' CreateProcess API parses command-line arguments, particularly when invoking .bat/.cmd files which are silently dispatched via cmd.exe. Language standard libraries and ecosystem tools historically escaped arguments assuming a single, consistent parser, but cmd.exe applies its own metacharacter rules (caret, quotes, ampersand, pipe), allowing crafted arguments to break out of quoting and inject additional commands. Affected CPEs span the Haskell process library, multiple Node.js branches, multiple PHP branches, Rust standard library, and yt-dlp - all of which expose subprocess-spawning APIs that downstream applications use to pass user input to external programs on Windows.

Know when Yt Dlp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Executive ViewAI

Why It Matters

A critical Windows API vulnerability (CVE-2024-3566, CVSS 9.8) in CreateProcess argument parsing allows remote command injection through popular language runtimes including Node.js, PHP, Rust, and tools like yt-dlp. Organizations using these technologies on Windows for development, CI/CD pipelines, or web services face immediate risk of unauthorized code execution; exploitation is particularly dangerous because publicly available exploit code exists, yet no vendor patch is currently available.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict input validation and sanitization on all arguments passed to child processes; (2) Where possible, avoid spawning batch files-use direct executable calls; (3) Apply network segmentation to limit lateral movement from compromised services; (4) Deploy intrusion detection signatures monitoring for CreateProcess abuse patterns; (5) Restrict application privileges following principle of least privilege; (6) Monitor vendor advisories for Node.js, PHP, Rust Foundation, and yt-dlp projects for patch availability.

Threat Intelligence Overview

EPSS Score

7.1%

Top 8% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 7.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.