CVE-2024-3566: A command inject vulnerability allows an attacker to perform command injection on Windows applications that in

This week

CRITICAL 9.8REMOTEUPGRADEUPGRADEUPGRADE

CVE-2024-3566 is a critical-severity flaw (CVSS 9.8) affecting process library, node.js, php. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Why this priority

Critical severity
EPSS top 6%: very likely to be exploited
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	6.8% (top 6%)
CISA exploited list	No
Weakness	CWE-77
Published	2024-04-10
Last modified	2026-06-17

Publisher (CNA): CERT/CC · Vendor: haskell · nodejs · php · rust-lang · yt-dlp project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-04-10 16:15 UTCPublished CVE record published
2026-06-17 07:44 UTCUpdated Record last modified

haskell process library UPGRADE

Affected: < 1.6.19.0

Fixed in: 1.6.19.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy process-library || rpm -q process-library || process-library --version

2. UPGRADE to 1.6.19.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade process-library

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade process-library

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

nodejs node.js UPGRADE

Affected: < 18.20.2 · >= 19.0.0 and < 20.12.2 · >= 21.0.0 and < 21.7.3

Fixed in: 18.20.2, 20.12.2, 21.7.3

Safe to downgrade to: a release before 19.0.0

1. Check installed version

apt-cache policy node.js || rpm -q node.js || node.js --version

2. UPGRADE to 18.20.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade node.js

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade node.js

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 19.0.0 (Debian / Ubuntu)

apt-cache madison node.js sudo apt install node.js=<VERSION_BEFORE_19.0.0> sudo apt-mark hold node.js

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list node.js sudo dnf downgrade node.js-<VERSION_BEFORE_19.0.0> sudo dnf versionlock add node.js

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

php php UPGRADE

Affected: < 8.1.28 · >= 8.2.0 and < 8.2.18 · >= 8.3.0 and < 8.3.6

Fixed in: 8.1.28, 8.2.18, 8.3.6

Safe to downgrade to: a release before 8.2.0

1. Check installed version

apt-cache policy php || rpm -q php || php --version

2. UPGRADE to 8.1.28 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade php

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade php

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.2.0 (Debian / Ubuntu)

apt-cache madison php sudo apt install php=<VERSION_BEFORE_8.2.0> sudo apt-mark hold php

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list php sudo dnf downgrade php-<VERSION_BEFORE_8.2.0> sudo dnf versionlock add php

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

rust-lang rust UPGRADE

Affected: < 1.77.2

Fixed in: 1.77.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy rust || rpm -q rust || rust --version

2. UPGRADE to 1.77.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade rust

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade rust

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

yt-dlp project yt-dlp UPGRADE

Affected: >= 2021.04.11 and < 2024.04.09

Fixed in: 2024.04.09

Safe to downgrade to: a release before 2021.04.11

1. Check installed version

apt-cache policy yt-dlp || rpm -q yt-dlp || yt-dlp --version

2. UPGRADE to 2024.04.09 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade yt-dlp

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade yt-dlp

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2021.04.11 (Debian / Ubuntu)

apt-cache madison yt-dlp sudo apt install yt-dlp=<VERSION_BEFORE_2021.04.11> sudo apt-mark hold yt-dlp

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list yt-dlp sudo dnf downgrade yt-dlp-<VERSION_BEFORE_2021.04.11> sudo dnf versionlock add yt-dlp

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · noctalia · FIXED · 5.4.1-1.fc46 · FEDORA-2026-a4755e8ef7 · source

sudo dnf upgrade --advisory=FEDORA-2026-a4755e8ef7

Fedora ELN · efifs · FIXED · 1.13-1.eln159 · FEDORA-2026-3fd0bb7307 · source

sudo dnf upgrade --advisory=FEDORA-2026-3fd0bb7307

Debian 12 · nodejs · NOT AFFECTED

Debian 13 · nodejs · NOT AFFECTED

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-3566?

process library: upgrade to 1.6.19.0; node.js: upgrade to 18.20.2, 20.12.2, 21.7.3; php: upgrade to 8.1.28, 8.2.18, 8.3.6. Exact commands for each OS are on this page.

Is CVE-2024-3566 being exploited?

CVE-2024-3566 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-3566 affect?

CVE-2024-3566 affects process library, node.js, php. Severity is critical (CVSS 9.8). A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

How urgent is CVE-2024-3566?

Priority 71/100. Critical severity; EPSS top 6%: very likely to be exploited; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Node.js vulnerabilities · PHP vulnerabilities · Windows vulnerabilities

References

← Back to latest CVEs