Findings

CVE-2024-3566

process: command injection via argument list on Windows

Published Nov 14, 2025 · updated May 30, 2026

# process: command injection via argument list on Windows The *process* library on Windows is vulnerable to a command injection vulnerability, via 's interpretation of arguments. Programs that invoke batch files ( , ) and pass arguments whose values are affected by program inputs may be affected. This issue was discovered in many programming languages' Windows process execution behaviour. It was tracked by CERT/CC as **VU#123335** and a coordinated disclosure was made on 2024-04-09 17:00 UTC. A fix was released in *process-1.6.19.0*. ## Background Unlike POSIX systems, Windows does not have a mechanism for passing multiple arguments.Command line parsing is up to individual programs. The *process* library defines the constructor for specifying an executable and its arguments: On Windows, the executable name and arguments are serialised into a single *command line* string, with separate arguments quoted separately. *process* then invokes the Windows [ ][doc-CreateProcess] routine with this command line string is given as the argument. [doc-CreateProcess]: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa ## Issue When executing or files, [ ][doc-CreateProcess] implicitly spawns . The command line construction does not escape characters with special meaning to . As a consequence, a command injection vulnerability arises when the following conditions are satisfied: - Program running on Windows - Program executes a or file - The argument values include or are influenced by program input ## Demonstration The following batch file, , merely prints the executable name the first two arguments (as interpreted by ): The following Haskell program executes with basic string arguments. The output is as expected: However, we can use a close quote and the character to induce to execute a program named in the argument: In addition to producing the above output, is executed. ## Mitigation The lack of a general mechanism on Window