Loading story…
CERT/CC published advisory VU#123335 for BatBadBut, a Windows command injection vulnerability class affecting multiple programming language runtimes that improperly escape arguments when launching commands. The issue stems from Microsoft Windows behavior in which CreateProcess can implicitly invoke cmd.exe for batch files such as .bat and .cmd, causing arguments escaped for normal process creation to be reinterpreted under cmd.exe parsing rules. Under those conditions, user-controlled input passed to a batch-file command can trigger command injection.
Research from GMO Flatt Security said exposure is broader than explicit batch-file execution because Windows PATHEXT can cause a program call without an extension to resolve to a batch file instead of an executable. The report added that simple quote escaping is insufficient because cmd.exe performs additional parsing and variable expansion, including %CMDCMDLINE%, before later processing stages. Affected ecosystems include multiple language runtimes, with some vendors issuing patches while others provided documentation updates or declined fixes, leaving developers to avoid batch-file invocation paths and review Windows command execution that includes untrusted arguments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CERT/CC published vulnerability note VU#123335 covering multiple programming languages that fail to escape arguments properly on Microsoft Windows. The note documents the cross-language nature of the issue highlighted by BatBadBut.
Affected vendors published advisories on April 9, 2024, in response to BatBadBut. According to the research, Haskell, Node.js, PHP, and Rust had patches available; Erlang, Go, Python, and Ruby issued documentation updates; and Java was listed as "Won’t fix."
Flatt Security published research on the BatBadBut vulnerability class, describing how Windows batch-file execution via CreateProcess and cmd.exe parsing differences can enable command injection in affected applications and runtimes. The research states that RyotaK reported related issues to multiple programming language vendors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a **critical remote code execution issue** in the Windows `ms-officecmd:` URI handler that let attackers inject arguments into Microsoft application launches through crafted JSON passed to `LocalBridge.exe` and `AppBridge.dll`. The flaw affected Windows 10 and 11 and could be used to start applications including **Teams, Skype, and Outlook** with attacker-controlled parameters, enabling arbitrary command execution, interception of Teams traffic, exposure of the Node.js debugger, and Outlook-assisted phishing scenarios. The researchers reported that **Internet Explorer 11** and **Edge Legacy** on Windows 10 could invoke the malicious URI without showing an external-protocol confirmation prompt, creating a drive-by exploitation path when Teams was installed and not already running. Microsoft initially dismissed the report, later reclassified it as **Critical RCE**, awarded a **$5,000 bounty**, and released a partial fix, but the researchers said the underlying argument-injection weakness remained present on fully patched Windows 10 and Windows 11 systems at the time of publication.
Jul 24, 2026
A high-severity vulnerability, tracked as CVE-2025-61787, was identified in Deno, a runtime for JavaScript, TypeScript, and WebAssembly. The flaw specifically affects Windows systems and allows for command injection when batch files are executed. The vulnerability arises because, on Windows, the CreateProcess() function implicitly invokes cmd.exe when executing batch files, even if the application does not explicitly specify it. This behavior enables attackers to inject arbitrary commands if they can influence the batch file execution process. Deno versions prior to 2.5.3 and 2.2.15 are confirmed to be vulnerable to this issue. The vulnerability is remotely exploitable, increasing the risk for systems running affected Deno versions on Windows. Security advisories highlight that the issue is fixed in Deno versions 2.5.3 and 2.2.15, and users are urged to upgrade to these or later versions to mitigate the risk. The vulnerability was disclosed publicly in early October 2025, and its high CVSS score of 8.1 reflects the significant risk it poses. The flaw could potentially allow attackers to execute arbitrary commands with the privileges of the Deno process, leading to system compromise or further lateral movement. The vulnerability does not appear to affect non-Windows platforms, as the underlying issue is tied to Windows-specific process creation behavior. No reports of active exploitation have been confirmed at the time of disclosure, but the remote exploitability and ease of triggering the flaw make it a priority for patching. The Deno development team responded promptly by releasing patched versions and providing detailed advisories to the community. Organizations using Deno in production on Windows are strongly advised to audit their deployments and ensure all instances are updated. Security teams should also review application logic to ensure that untrusted input cannot influence batch file execution. The vulnerability underscores the importance of understanding platform-specific behaviors in cross-platform runtimes. Deno's maintainers have also recommended additional security best practices for users who cannot immediately upgrade. The disclosure has prompted broader discussions about secure process execution and command injection risks in modern runtimes.
Jun 29, 2026
Microsoft patched a high-severity **remote code execution** issue in the modern *Windows Notepad* (Microsoft Store version) tracked as **CVE-2026-20841**, where improper validation of links in Markdown (`.md`) files can lead to arbitrary command execution in the context of the logged-in user. The flaw can be triggered when a victim opens a specially crafted Markdown file and clicks a rendered hyperlink; Notepad’s Markdown rendering/tokenization pipeline turns link text into interactive elements, and the click handler passes attacker-controlled link values onward with insufficient sanitization. Technical reporting indicates Notepad forwards the link target to `ShellExecuteExW()` with only minimal filtering (e.g., stripping leading/trailing slashes), allowing malicious protocol URIs such as `file://` and `ms-appinstaller://` to be invoked via registered protocol handlers. Exploitation is primarily social-engineering driven (email, downloads, or other delivery mechanisms) and requires user interaction (opening the file and clicking the link), but can result in execution of attacker-chosen commands or loading attacker-controlled content depending on protocol handler behavior and system configuration; the issue was disclosed via **Zero Day Initiative** and credited to researchers including Cristian Papa and Alasdair Gorniak (Delta Obscura), with additional analysis referenced by third-party reporting.
Jul 4, 2026