{"id":"EUVD-2024-54826","revision":"692eca43fa5e424bbd505399ddf8ca45","records":[{"revision":"692eca43fa5e424bbd505399ddf8ca45","observedAt":"2026-11-07T00:37:40.261+00:00","statement":{"source":"euvd","id":"EUVD-2024-54826","aliases":["CVE-2024-58266"],"title":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","score":3.2,"severity":null}],"references":["https://rustsec.org/advisories/RUSTSEC-2024-0006.html","https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27","https://crates.io/crates/shlex"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54826","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 27, 2025, 12:00:00 AM","dateUpdated":"Jul 28, 2025, 3:03:56 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2025:20717-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2024-58266","CVE-2025-3416","CVE-2025-55159"]},{"id":"SUSE-SU-2025:20858-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2024-12224","CVE-2024-43806","CVE-2024-58266","CVE-2025-3416","CVE-2025-55159"]},{"id":"SUSE-SU-2025:03077-1","title":"Security update for rav1e","vulnerabilityIds":["CVE-2024-58266"]},{"id":"openSUSE-SU-2025:15433-1","title":"framework-inputmodule-control-0.2.0-3.1 on GA media","vulnerabilityIds":["CVE-2023-53156","CVE-2024-58266"]},{"id":"msrc_CVE-2024-58266","title":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","vulnerabilityIds":["CVE-2024-58266"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-54826","identifiers":["EUVD-2024-54826","CVE-2024-58266"]},"retained":false,"historicalAffected":[]}],"coverage":[]}