CVE-2024-3566 is a critical command injection (CVSS 9.8) affecting applications on Windows that run batch files through CreateProcess, including some language runtimes such as Node.js and the Haskell process library. Update your runtime to a patched release and never pass untrusted arguments to commands that may resolve to batch files.
Weakness class: CWE-77.
What's affected
- Platform: Microsoft Windows applications that indirectly depend on the CreateProcess function when specific conditions are met.
- Products named in the record: the Haskell process library and Node.js.
- Haskell: the CERT/CC page quotes the vendor as saying a fix was released in process 1.6.19.0.
- Node.js: CERT/CC lists it as affected and references release notes for v18.20.2, v20.12.2 and v21.7.3 but does not state explicitly that these fix this CVE. Confirm against the Node.js advisory.
- Severity: Critical, CVSS 9.8, per the record. The KEV flag is false.
- Microsoft lists itself as not affected, noting the underlying issue was identified in 2011.
How to check if you're exposed
- Find out whether your software runs on Windows and starts child processes, for example with child_process in Node.js or the process package in Haskell.
- Check the runtime version: check the Node.js version with the node version flag and compare it with the patched releases in the Node.js advisory.
- For Haskell, look at your cabal freeze file or lock file for the process version.
- Search your code for calls that start commands from user supplied input, especially where the file extension is omitted so Windows may pick a .bat or .cmd file.
- Scan your repositories with the free in-browser dependency scan to list affected runtime and library versions.
What to do now
- Upgrade the runtime or library to a release the vendor identifies as fixed.
- Where you cannot upgrade, avoid running batch files with user controlled arguments.
- Specify the full executable name and extension so a batch file cannot be resolved by accident.
- If you must pass user data to a batch file, escape and neutralise it yourself, as CERT/CC advises.
- For Erlang, CERT/CC advises not using open_port with spawn or spawn_executable options on untrusted input.
Why it matters
Windows runs batch files through cmd.exe, which has its own parsing rules separate from those of the program calling it. A language runtime that escapes arguments for CreateProcess may therefore not escape them for cmd.exe. The CERT/CC summary describes this as a failure to escape arguments properly, which lets crafted input run as extra commands. The class is CWE-77, command injection.
This is a good example of a cross ecosystem bug. One design quirk produced several CVEs across many languages, and the record points to related ones such as CVE-2024-24576 for Rust and CVE-2024-1874 for PHP. Teams often patch one and miss the others.
Reachability matters here. A dependency may contain the weak function, but you are only exposed if your code calls it on Windows with untrusted input. Reachability analysis helps separate real exposure from noise.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect Linux servers?
The record describes Windows applications. Linux runtimes do not go through CreateProcess and cmd.exe.
Is it exploited in the wild?
The record does not mark it as a KEV entry.
Sources
- https://kb.cert.org/vuls/id/123335
- https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ (listed in the record, not fetched)
- Gold entry for CVE-2024-3566
Last reviewed: 19 October 2026.
