9.8
Critical
CVE-2024-3566 A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
Description
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node.js 21.7 | earliest → 21.7.2 | No fix stated |
| GoLang | Versions not published | |
| Haskel | Versions not published | |
| nodejs 21.7 | earliest → 21.7.2 | No fix stated |
| process_library 1.6 | earliest → < 1.6.19.0 | 1.6.19.0 |
| rust 1.77 | earliest → < 1.77.2 | 1.77.2 |
| thephpgroup | Versions not published | |
| yt-dlp | Versions not published |
References
- flatt.tech flatt.tech
- learn.microsoft.com learn.microsoft.com
- kb.cert.org kb.cert.org
- www.cve.org www.cve.org
- www.cve.org www.cve.org
- www.cve.org www.cve.org
- www.kb.cert.org www.kb.cert.org
Timeline
- Published
- Last modified
Other CVEs of Node.js
The 4 CVEs of Node.js →
CVE-2024-22019
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked…
7.5
High
CVE-2019-5739
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier
Not rated
CVE-2019-5737
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can…
Not rated