Most recent entries from all

BIT-node-2024-3566 — Command injection vulnerability in programing languages on Microsoft Windows operating system.

Affected: Bitnami: node

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

EUVD-2026-261221

fkie_cve-2024-3566

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

GHSA-9xch-xvj3-fmf3

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

gsd-2024-3566

HSEC-2024-0003 — process: command injection via argument list on Windows

Affected: Hackage: process

# process: command injection via argument list on Windows

The *process* library on Windows is vulnerable to a command injection vulnerability, via `cmd.exe`'s interpretation of arguments. Programs that invoke batch files (`.bat`, `.cmd`) and pass arguments whose values are affected by program inputs may be affected.

This issue was discovered in many programming languages' Windows process execution behaviour. It was tracked by CERT/CC as **VU#123335** and a coordinated disclosure was made on 2024-04-09 17:00 UTC.

A fix was released in *process-1.6.19.0*.

## Background

Unlike POSIX systems, Windows does not have a mechanism for passing multiple arguments.Command line parsing is up to individual programs.

The *process* library defines the `RawCommand` constructor for specifying an executable and its arguments:

```haskell data CmdSpec = ShellCommand String | RawCommand FilePath [String] ```

On Windows, the `RawCommand` executable name and arguments are serialised into a single *command line* string, with separate arguments quoted separately. *process* then invokes the Windows [`CreateProcess`][doc-CreateProcess] routine with this command line string is given as the `lpCommandLine` argument.

[doc-CreateProcess]: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa

## Issue

When executing `.bat` or `.cmd` files, [`CreateProcess`][doc-CreateProcess] implicitly spawns `cmd.exe`. The `System.Process` command lin…

msrc_CVE-2024-3566 — Command injection vulnerability in programing languages on Microsoft Windows operating system.

msrc_CVE-2024-3566