HSEC-2024-0003
NoneCVSS
—
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
process: command injection via argument list on Windows
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | node | 1.77.2 | 18.19.0 |
| Bitnami | node-min | 1.77.2 | 18.20.5 |
| Hackage | process | 1.0.0.0 | 1.6.19.0 |
| Hackage | process | 1.0.0.0 | 1.6.23.0 |
| Ubuntu:22.04:LTS | yt-dlp | 0 | No fix |
| Ubuntu:24.04:LTS | yt-dlp | 0 | No fix |
| pypi | yt-dlp | 2021.04.11 | No fix |
Related vulnerabilities
- CVE-2024-24576 Rust is a programming language. Same vulnerability
- CVE-2024-3566 A command inject vulnerability allows an attacker to perform command injection on Windows… Same vulnerability
- CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js… Also affects node
- CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size… Also affects node
- CVE-2025-55132 A flaw in Node.js's permission model allows a file's access and modification timestamps… Also affects node
- CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate… Also affects node
- CVE-2025-55131 A flaw in Node.js's buffer allocation logic can expose uninitialized memory when… Also affects node
- CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and… Also affects node