UpHeron
All vulnerabilities

Servers and applications

CVE-2024-3566

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Severity
Critical 9.8
Published
10 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.1.28, 8.2.18, 8.3.6, 18.20.2, 20.12.2, 21.7.3
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • Every version before 18.20.2
  • From 19.0.0 before 20.12.2
  • From 21.0.0 before 21.7.3
PHPServers and applications · cpe:a:php:php
  • Every version before 8.1.28
  • From 8.2.0 before 8.2.18
  • From 8.3.0 before 8.3.6
RustServers and applications · cpe:a:rust-lang:rust
  • Every version before 1.77.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-3566
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-3566