Unrated
Command execution hijack on Windows with Process class in symfony/process
Type: advisorySources: OSV
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-51736
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:25 UTC · Revision 1
Source evidence
Command execution hijack on Windows with Process class in symfony/process
core-osv · Original sourcePublished 6 Nov 2024, 20:51 UTC
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
osv:CVE-2024-51736
Complete source record
{
"id": "b766f1ccf3a6240e9b7f1062bdf8e00255f719749f089f44b0e3668c520c9137",
"url": "https://osv.dev/vulnerability/CVE-2024-51736",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Command execution hijack on Windows with Process class in symfony/process",
"summary": "Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
"evidence": "osv:CVE-2024-51736",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2024-51736",
"aliases": [
"CVE-2024-51736",
"GHSA-qq5c-677p-737q"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/symfony/security-http",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "7152f0e4e292719cdeb8306076448036e025569b"
},
{
"introduced": "6530589fc40cdceda230fb6a69173ce52fa8b5ca"
},
{
"fixed": "cc13b601fc844036fd6c8e7307845da145d5998b"
},
{
"introduced": "f84d7d3c93e6a884908402775199b1f7d55c7be1"
},
{
"fixed": "d551ee81377b2b12abe04135564f2e4e6945f90f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.4.46"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.7"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/symfony/symfony",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "057d88bef2d18a10d3b0b8fb093332131dc58e2f"
},
{
"introduced": "aa4e97099b5a67bdc9f2387fe8d099f5c712f81c"
},
{
"fixed": "d1797e5b5b549673b1d5aac7a081af8db9f258e6"
},
{
"introduced": "d78c5f403d7ee794993660b1d5155536edd36fc1"
},
{
"fixed": "5001143568bc2bce9ec77f7a85076aa75d38795e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.4.46"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v7.1.6",
"v6.4.13",
"v5.4.45",
"v7.1.5",
"v6.4.12",
"v5.4.44",
"v7.1.4",
"v6.4.11",
"v5.4.43",
"v7.1.3",
"v6.4.9",
"v5.4.41",
"v7.1.2",
"v6.4.8",
"v5.4.40",
"v7.1.1",
"v7.1.0-RC1",
"v7.1.0",
"v7.1.0-BETA1",
"v6.4.7",
"v5.4.39",
"v6.4.4",
"v5.4.38",
"v5.4.36",
"v5.4.35",
"v6.4.3",
"v7.0.1",
"v6.4.0-RC2",
"v6.4.0",
"v5.4.31",
"v7.0.0-RC2",
"v7.0.0",
"v6.4.0-RC1",
"v6.4.0-BETA3",
"v6.4.0-BETA1",
"v5.4.30",
"v5.4.28",
"v5.4.26",
"v5.4.23",
"v6.3.0-RC1",
"v6.3.0-BETA1",
"v5.4.22",
"v5.4.21",
"v5.4.20",
"v5.4.19",
"v5.4.17",
"v6.2.0",
"v6.2.0-RC1",
"v5.4.15",
"v6.2.0-BETA3",
"v6.2.0-BETA1",
"v5.4.13",
"v5.4.11",
"v5.4.12",
"v5.4.10",
"v6.1.0-RC1",
"v6.1.0",
"v5.4.9",
"v6.1.0-BETA2",
"v5.4.8",
"v6.1.0-BETA1",
"v5.4.5",
"v5.4.3",
"v5.4.2",
"v5.4.0",
"v6.0.0",
"v5.4.0-RC1",
"v5.4.0-BETA2",
"v5.4.0-BETA1",
"v5.3.0-RC1",
"v5.3.0-BETA4",
"v5.3.0-BETA3",
"v5.3.0-BETA2",
"v5.3.0-BETA1",
"v5.2.0",
"v5.2.0-RC2",
"v5.2.0-RC1",
"v5.2.0-BETA3",
"v5.2.0-BETA2",
"v5.2.0-BETA1",
"v5.1.0-RC1",
"v5.1.0-BETA1",
"v5.0.0-RC1",
"v5.0.0-BETA2",
"v5.0.0-BETA1",
"v4.3.0-BETA2",
"v4.3.0-BETA1",
"v4.2.0-RC1",
"v4.2.0-BETA2",
"v4.2.0",
"v4.2.0-BETA1",
"v4.1.0-BETA1",
"v4.0.0-RC1",
"v4.0.0-BETA4",
"v4.0.0-BETA3",
"v4.0.0-BETA2",
"v4.0.0-BETA1",
"v3.3.0-RC1",
"v3.3.0-BETA1",
"v3.2.0-RC1",
"v3.2.0-BETA1",
"v3.1.1",
"v3.1.0-RC1",
"v3.1.0-BETA1",
"v3.1.0",
"v3.0.0",
"v3.0.0-BETA1",
"v2.6.0-BETA1",
"v2.5.0-BETA1",
"v2.5.2",
"v2.5.1",
"v2.5.0-RC1",
"v2.5.0",
"v2.5.0-BETA2",
"v2.4.0-RC1",
"v2.4.0-BETA2",
"v2.4.0-BETA1",
"v6.4.10",
"v5.4.42",
"v6.4.6",
"v6.4.5",
"v5.4.37",
"v6.4.2",
"v5.4.34",
"v6.4.1",
"v5.4.33",
"v5.4.32",
"v7.0.0-RC1",
"v7.0.0-BETA3",
"v7.0.0-BETA2",
"v6.4.0-BETA2",
"v7.0.0-BETA1",
"v5.4.29",
"v5.4.27",
"v5.4.25",
"v5.4.24",
"v6.3.0-BETA3",
"v6.3.0-BETA2",
"v5.4.18",
"v5.4.16",
"v6.2.0-BETA2",
"v5.4.14",
"v5.4.7",
"v5.4.6",
"v5.4.4",
"v5.4.1",
"v6.0.0-RC1",
"v6.0.0-BETA3",
"v5.4.0-BETA3",
"v6.0.0-BETA2",
"v6.0.0-BETA1",
"v2.3.0-BETA2",
"v2.3.0-BETA1",
"v2.2.0-BETA2",
"v2.2.0-BETA1",
"v2.1.0",
"v2.1.0-RC2",
"v2.1.0-RC1",
"v2.1.0-BETA4",
"v2.1.0-BETA3",
"v2.1.0-BETA2",
"v2.1.0-BETA1",
"v2.0.0",
"v2.0.0-RC6",
"v2.0.0-RC5",
"v2.0.0-RC4",
"v2.0.0-RC3",
"v2.0.0-RC2",
"v2.0.0-RC1",
"v2.0.0BETA5",
"v2.0.0BETA4",
"v2.0.0BETA3",
"v2.0.0BETA2",
"v2.0.0BETA1",
"vPR9",
"vPR8",
"v2.0.0PR8",
"vPR6",
"vPR5",
"vPR4",
"vPR3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51736.json"
}
}
],
"modified": "2026-10-28T02:30:24.936404382Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51736.json",
"https://github.com/symfony/symfony/security/advisories/GHSA-qq5c-677p-737q",
"https://nvd.nist.gov/vuln/detail/CVE-2024-51736"
],
"provider_metadata": {
"cwe_ids": [
"CWE-77"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51736.json"
}
},
"related_cves": [
{
"value": "CVE-2024-51736",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 491624,
"published_at": "2024-11-06T20:51:38.536+00:00"
}