Low, CVSS 3.2crates.ioPublished
Multiple issues involving quote API in shlex
CVE-2024-58266 · GHSA-r7qv-8r2h-pg27
- Affected
- crates.io shlex < 1.3.0
- Fixed in
- 1.3.0· Vendor fix available
- Issue
- Issue 1: Failure to quote characters Affected versions of this crate allowed the bytes { and \xa0 to appear unquoted and unescaped in command arguments. If the output of quote or join is passed to a shell, then what should be a single command argument could be interpreted as multiple arguments. This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution. The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired. Workaround: Check for the bytes { and \xa0 in quote/join input or output. (Note: { is problematic because it is used for glob expansion. \xa0 is problematic because it's treated as a word separator in specific…
Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.