{"id":"EUVD-2024-54826","enisaUuid":"e42ad32d-0495-37b5-ba65-f1e95b2b8789","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","datePublished":"Jul 27, 2025, 12:00:00 AM","dateUpdated":"Jul 28, 2025, 3:03:56 PM","baseScore":3.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","references":"https://rustsec.org/advisories/RUSTSEC-2024-0006.html\nhttps://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27\nhttps://crates.io/crates/shlex\n","aliases":"CVE-2024-58266\n","assigner":"mitre","epss":0.78,"enisaIdProduct":[{"id":"2f0afd1e-db8c-3706-b5d9-f2c079604e99","product":{"name":"shlex","vendor":{"name":"comex"}},"product_version":"0 \u003c1.2.1"}],"enisaIdVendor":[{"id":"d022fafc-5d38-346d-9460-d0771ba252f1","vendor":{"name":"comex"}}],"enisaIdVulnerability":[{"id":"1f62fa18-0ef3-3531-aad7-3d6c6d1c9b00","vulnerability":{"id":"CVE-2024-58266","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","datePublished":"Jul 27, 2025, 12:00:00 AM","dateUpdated":"Jul 28, 2025, 3:03:56 PM","status":"PUBLISHED","baseScore":3.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","references":"https://rustsec.org/advisories/RUSTSEC-2024-0006.html\nhttps://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27\nhttps://crates.io/crates/shlex\n","enisa_id":"EUVD-2024-54826\n","assigner":"mitre","epss":0.78,"dataProcessed":"Nov 8, 2026, 7:19:42 AM","vulnerabilityProduct":[{"id":"1cd0b89c-2db2-486a-bf88-8ced903af98e","product":{"name":"shlex","vendor":{"name":"comex"}},"product_version":"0 \u003c1.2.1"},{"id":"dc85293f-61d8-3d29-9b48-312015e8e0cf","product":{"name":"shlex","vendor":{"name":"comex"}},"product_version":"0 \u003c1.2.1"}],"vulnerabilityVendor":[{"id":"b5591aca-bc71-32b6-a3b3-562be1876d81","vendor":{"name":"comex"}}]}},{"id":"ab68f86e-caa9-3e63-b2e6-04da02252f65","vulnerability":{"id":"GHSA-r7qv-8r2h-pg27","description":"Multiple issues involving quote API in shlex","datePublished":"Jan 22, 2024, 9:21:30 PM","dateUpdated":"Jul 28, 2025, 3:58:54 PM","baseScore":null,"references":"https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58266\nhttps://github.com/comex/rust-shlex\nhttps://rustsec.org/advisories/RUSTSEC-2024-0006.html\n","enisa_id":"EUVD-2024-54826\n","aliases":"CVE-2024-58266\nGHSA-r7qv-8r2h-pg27\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:08:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"07d3608f-f42b-3d7e-8ffa-b99518923d06","advisory":{"id":"SUSE-SU-2025:20717-1","description":"Security update for rust-keylime","summary":"Security update for rust-keylime","datePublished":"Sep 16, 2025, 7:50:08 AM","dateUpdated":"Sep 20, 2026, 6:17:10 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20717-1.json\nhttps://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/\nhttps://lists.suse.com/pipermail/sle-updates/2025-September/041931.html\nhttps://bugzilla.suse.com/1242623\nhttps://bugzilla.suse.com/1247193\nhttps://bugzilla.suse.com/1248006\nhttps://www.suse.com/security/cve/CVE-2024-58266/\nhttps://www.suse.com/security/cve/CVE-2025-3416/\nhttps://www.suse.com/security/cve/CVE-2025-55159/\n","aliases":"CVE-2024-58266\nCVE-2025-3416\nCVE-2025-55159\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"21a6286c-07b4-31c9-be45-7a13ce3a0951","product":{"name":"rust-keylime-0:0.2.8+12-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2f8b26e1-fa6f-35c5-a90c-9deacb80bf75","product":{"name":"rust-keylime-0.2.8+12-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"3b7ccc72-f52f-3c1a-88f2-3394a145e776","product":{"name":"rust-keylime-0.2.8+12-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"46f870ea-41d5-3d0b-a8e4-575a255c7cb1","product":{"name":"rust-keylime-0:0.2.8+12-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6b3e2019-33b4-3e13-a4da-568bf1f1a431","product":{"name":"rust-keylime-0:0.2.8+12-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"bd6045f8-a3bb-301c-84be-490380641585","product":{"name":"SUSE Linux Micro 6.0","vendor":{"name":"SUSE"}}},{"id":"e441247a-badb-3cc7-ad7a-f68fbbbad06f","product":{"name":"rust-keylime-0.2.8+12-1.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"0ad94f22-cbce-3efa-9cf1-cca7c3b9ff77","advisory":{"id":"SUSE-SU-2025:20858-1","description":"Security update for rust-keylime","summary":"Security update for rust-keylime","datePublished":"Oct 14, 2025, 1:18:43 PM","dateUpdated":"Sep 20, 2026, 6:19:27 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20858-1.json\nhttps://www.suse.com/support/update/announcement/2025/suse-su-202520858-1/\nhttps://lists.suse.com/pipermail/sle-updates/2025-October/042320.html\nhttps://bugzilla.suse.com/1229952\nhttps://bugzilla.suse.com/1230029\nhttps://bugzilla.suse.com/1242623\nhttps://bugzilla.suse.com/1243861\nhttps://bugzilla.suse.com/1247193\nhttps://bugzilla.suse.com/1248006\nhttps://www.suse.com/security/cve/CVE-2024-12224/\nhttps://www.suse.com/security/cve/CVE-2024-43806/\nhttps://www.suse.com/security/cve/CVE-2024-58266/\nhttps://www.suse.com/security/cve/CVE-2025-3416/\nhttps://www.suse.com/security/cve/CVE-2025-55159/\n","aliases":"CVE-2024-12224\nCVE-2024-43806\nCVE-2024-58266\nCVE-2025-3416\nCVE-2025-55159\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"079239ca-e1ee-323d-bef0-e5dbd31a1cb1","product":{"name":"rust-keylime-0:0.2.8+12-slfo.1.1_1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"2d54b7ee-9b58-341e-a198-849fec7a3518","product":{"name":"rust-keylime-0.2.8+12-slfo.1.1_1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"3ed970bf-6417-3133-a2de-c6a2ea60141c","product":{"name":"rust-keylime-0.2.8+12-slfo.1.1_1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"59833148-2633-3dc1-a242-de4accbb3f26","product":{"name":"SUSE Linux Micro 6.1","vendor":{"name":"SUSE"}}},{"id":"59dc5feb-2c1a-3733-8e33-0a4243b49a1b","product":{"name":"rust-keylime-0.2.8+12-slfo.1.1_1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"70257945-21b8-3203-b97f-d953b8bd7588","product":{"name":"rust-keylime-0:0.2.8+12-slfo.1.1_1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8c361b5a-8a2d-33a9-ae83-00a14c812c5b","product":{"name":"rust-keylime-0:0.2.8+12-slfo.1.1_1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bb39bcd5-8d4b-31a0-b58d-d80267fe6f57","product":{"name":"rust-keylime-0.2.8+12-slfo.1.1_1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"dd3c7ab7-d710-3b46-96cc-d87ebeca7916","product":{"name":"rust-keylime-0:0.2.8+12-slfo.1.1_1.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"8acee636-f6ff-3827-a54c-ddb384f86216","advisory":{"id":"SUSE-SU-2025:03077-1","description":"Security update for rav1e","summary":"Security update for rav1e","datePublished":"Sep 4, 2025, 10:54:50 AM","dateUpdated":"Sep 4, 2025, 10:54:50 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03077-1.json\nhttps://www.suse.com/support/update/announcement/2025/suse-su-202503077-1/\nhttps://lists.suse.com/pipermail/sle-updates/2025-September/041515.html\nhttps://bugzilla.suse.com/1230028\nhttps://bugzilla.suse.com/1247207\nhttps://www.suse.com/security/cve/CVE-2024-58266/\n","aliases":"CVE-2024-58266\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"0322a7b2-edc7-3108-9791-26da15d1415b","product":{"name":"librav1e0_6-0.6.6-150600.3.6.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1d035de5-bc01-333a-8012-d2925a8aec98","product":{"name":"rav1e-0.6.6-150600.3.6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"332b939c-e8bc-38ba-a7ef-6d2836734aa6","product":{"name":"rav1e-0.6.6-150600.3.6.1.i586","vendor":{"name":"SUSE"}}},{"id":"456dc43c-689a-327c-a081-7462244ab406","product":{"name":"rav1e-devel-0.6.6-150600.3.6.1.i586","vendor":{"name":"SUSE"}}},{"id":"45d3bfe1-41d7-3d9c-ab75-ac7ec5764b23","product":{"name":"librav1e0_6-0.6.6-150600.3.6.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"74b4dd09-d19b-32f8-a961-d271608d6850","product":{"name":"librav1e0_6-0.6.6-150600.3.6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"758e6c94-8c3a-3c12-93ae-7c38a6764e63","product":{"name":"openSUSE Leap 15.6","vendor":{"name":"SUSE"}}},{"id":"842c85f3-676d-32c9-960c-16a11881d8c4","product":{"name":"rav1e-devel-0.6.6-150600.3.6.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"9840f78e-5566-33d2-ade4-2b1ec16e73a7","product":{"name":"rav1e-0.6.6-150600.3.6.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"98977f65-c3b1-3d8d-bdd9-06ce12e4e9b0","product":{"name":"SUSE Linux Enterprise Module for Basesystem 15 SP7","vendor":{"name":"SUSE"}}},{"id":"a879f788-e3d5-3b4c-b262-89e8e54e13d7","product":{"name":"rav1e-devel-0.6.6-150600.3.6.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a953d2bf-5c25-3ee7-b0a7-2845b5aeeb08","product":{"name":"rav1e-0.6.6-150600.3.6.1.s390x","vendor":{"name":"SUSE"}}},{"id":"b12586ec-5b00-3c30-be63-94a396b8c119","product":{"name":"librav1e0_6-64bit-0.6.6-150600.3.6.1.aarch64_ilp32","vendor":{"name":"SUSE"}}},{"id":"b4241823-b929-38c9-bdd6-2485697c1d8f","product":{"name":"rav1e-devel-0.6.6-150600.3.6.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c625036a-b6e7-37b2-930b-4d49037b5cf4","product":{"name":"librav1e0_6-0.6.6-150600.3.6.1.i586","vendor":{"name":"SUSE"}}},{"id":"cc11ec08-6a78-39e6-b6c2-bbcbc4b73235","product":{"name":"librav1e0_6-0.6.6-150600.3.6.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cf952dcd-b766-397b-bf5f-ffc2ac1e1943","product":{"name":"librav1e0_6-32bit-0.6.6-150600.3.6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"dd8fa5d0-584b-3a68-8003-2f90ae14cd51","product":{"name":"rav1e-0.6.6-150600.3.6.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"e24dbc9b-43c8-3a0c-8db1-cca5925bc175","product":{"name":"rav1e-devel-0.6.6-150600.3.6.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f0f21b0f-e853-370b-a347-0c137f53e3d7","product":{"name":"SUSE Linux Enterprise Module for Basesystem 15 SP6","vendor":{"name":"SUSE"}}}]}},{"id":"c627c855-53d4-3191-9ff3-9b7db094aeb6","advisory":{"id":"openSUSE-SU-2025:15433-1","description":"framework-inputmodule-control-0.2.0-3.1 on GA media","summary":"framework-inputmodule-control-0.2.0-3.1 on GA media","datePublished":"Aug 12, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:39:34 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15433-1.json\nhttps://www.suse.com/security/cve/CVE-2023-53156/\nhttps://www.suse.com/security/cve/CVE-2024-58266/\n","aliases":"CVE-2023-53156\nCVE-2024-58266\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0b3423b5-54fb-3468-aca7-2e0fba4a50c9","product":{"name":"framework-inputmodule-udev-rules-0.2.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"10a4ec52-1473-3c0f-b718-63ce26a0d2d0","product":{"name":"framework-inputmodule-udev-rules-0:0.2.0-3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"11d5a01e-3d88-3145-a5cf-0a73d45f2f09","product":{"name":"framework-inputmodule-control-0:0.2.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3f09dea2-a0dd-383e-aef6-b7be519f97e9","product":{"name":"framework-inputmodule-udev-rules-0:0.2.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5909734c-1a44-3cef-bb54-151fac87bdad","product":{"name":"framework-inputmodule-udev-rules-0:0.2.0-3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"62656f36-46c7-37c9-bc41-33e110651497","product":{"name":"framework-inputmodule-udev-rules-0.2.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"7e2d987e-97a0-3a21-a0d8-5f611cec13b9","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"87e8cd66-18f0-3f90-9405-6ffebdedcfd8","product":{"name":"framework-inputmodule-control-0:0.2.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"89ee6654-fbb3-3128-b695-93bee335e24c","product":{"name":"framework-inputmodule-udev-rules-0:0.2.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"916b9c04-bdbf-3bac-a6c8-f8f7a24d8fa4","product":{"name":"framework-inputmodule-control-0:0.2.0-3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"bb005064-cbdd-34d6-afa9-3dc62c2cba06","product":{"name":"framework-inputmodule-control-0:0.2.0-3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c002c464-e545-3354-aa7d-7b357a42e31f","product":{"name":"framework-inputmodule-control-0.2.0-3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c2498fe9-c937-3ee6-b14f-2c9713e13ddf","product":{"name":"framework-inputmodule-control-0.2.0-3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d0f28ec5-056e-33eb-96bf-8c048eb84db4","product":{"name":"framework-inputmodule-control-0.2.0-3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ecfbd7bb-26fa-3e55-b740-a6e508a4ed30","product":{"name":"framework-inputmodule-udev-rules-0.2.0-3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f25def68-cfe9-3759-9123-9c15846e9619","product":{"name":"framework-inputmodule-control-0.2.0-3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f6d592a9-673d-36bf-b63f-4b3defbd0fed","product":{"name":"framework-inputmodule-udev-rules-0.2.0-3.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"f45a8654-3da7-329d-bfc2-c67b111319c1","advisory":{"id":"msrc_CVE-2024-58266","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","datePublished":"Sep 4, 2025, 3:03:00 AM","dateUpdated":"Oct 14, 2026, 2:40:03 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-58266.json\n","aliases":"CVE-2024-58266\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"3065fd33-1e9b-3644-ad94-0f7b16524a7c","product":{"name":"kata-containers","vendor":{"name":"kata-containers"}}},{"id":"34a7f729-8c14-3359-8407-abcd02b5cdf3","product":{"name":"azl3 rust 1.75.0-22","vendor":{"name":"Microsoft"}}},{"id":"4c5e968a-03f9-3ceb-b529-9b6c909f06b3","product":{"name":"azl3 rust 1.86.0-3","vendor":{"name":"Microsoft"}}},{"id":"6891ab29-b61f-3abc-9904-e48b1f3c5ea5","product":{"name":"rust","vendor":{"name":"rust-lang"}}},{"id":"6959b26b-b394-3894-99eb-b8df891301f9","product":{"name":"azl3 rust 0:1.86.0-3.azl3","vendor":{"name":"Microsoft"}}},{"id":"6c05afbd-62a3-36b9-9395-f9d431b48bf2","product":{"name":"\u003cazl3 rust 1.86.0-3","vendor":{"name":"Microsoft"}}},{"id":"860ca176-20d1-3886-a522-38baf596344e","product":{"name":"cbl2 rust 1.72.0-10","vendor":{"name":"Microsoft"}}},{"id":"8c87f1cc-6824-34f9-8bb8-815a9c6ab02a","product":{"name":"azl3 rust 1.75.0-21","vendor":{"name":"Microsoft"}}},{"id":"a3683737-7a72-3a3c-8c75-3351d8b7e812","product":{"name":"azl3 rust 1.75.0-20","vendor":{"name":"Microsoft"}}},{"id":"b07ae884-c7ad-37fd-99b0-bacc4f08f850","product":{"name":"azl3 rust 1.75.0-18","vendor":{"name":"Microsoft"}}},{"id":"c3fb9843-b1c8-36cf-bee2-cb264de10975","product":{"name":"cbl2 rust 1.72.0-11","vendor":{"name":"Microsoft"}}},{"id":"c4591e39-1a3b-38c0-b4ea-cf2c9a691e58","product":{"name":"azl3 rust 1.75.0-17","vendor":{"name":"Microsoft"}}},{"id":"c4a2496b-229f-3bb3-b1b3-ea8ca92bb977","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"e1ded7a4-38c6-35aa-8765-623e9a7f3bf9","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"eb4ae0f8-1b84-3e7a-a435-414c95f0ffef","product":{"name":"azl3 rust 0:1.75.0-30.azl3","vendor":{"name":"Microsoft"}}},{"id":"f926769f-0a73-3e49-8a59-24c4d26b016a","product":{"name":"kata-containers-cc","vendor":{"name":"Microsoft"}}},{"id":"f9282f73-4a02-3c7f-926c-7222bbeeb761","product":{"name":"2.0","vendor":{"name":"Smiths Medical"}}}]}}]}