CVE-2024-58266
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
Summary
Multiple issues involving quote API
Original description
The description as published by the source.
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
crates.io
shlex
[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.3.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-58266 rust-shlex
- Ubuntu UBUNTU-CVE-2024-58266 rust-shlex
References
- advisory rustsec.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web crates.io
- web github.com