{"id":"GHSA-r7qv-8r2h-pg27","revision":null,"records":[{"revision":"d2d3b8d40e7f4b209a34e2a5d3e96c63","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-58266","aliases":[],"title":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","state":0,"publishedAt":"2025-07-27T00:00:00+00:00","modifiedAt":"2025-07-28T15:03:56.004+00:00","affected":[{"ecosystem":"Vendor product","name":"shlex","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"shlex\",\n                    \"vendor\": \"comex\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.2.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","score":3.2,"severity":"LOW"}],"references":["https://rustsec.org/advisories/RUSTSEC-2024-0006.html","https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27","https://crates.io/crates/shlex"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-58266","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-58266","identifiers":["CVE-2024-58266"]},"retained":false,"historicalAffected":[]},{"revision":"4ec237ff425442c0aac88964e9d20665","observedAt":"2026-11-09T01:12:34.432+00:00","statement":{"source":"euvd","id":"EUVD-2024-54826","aliases":["CVE-2024-58266"],"title":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","score":3.2,"severity":null}],"references":["https://rustsec.org/advisories/RUSTSEC-2024-0006.html","https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27","https://crates.io/crates/shlex"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54826","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 27, 2025, 12:00:00 AM","dateUpdated":"Jul 28, 2025, 3:03:56 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2025:20717-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2024-58266","CVE-2025-3416","CVE-2025-55159"]},{"id":"SUSE-SU-2025:20858-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2024-12224","CVE-2024-43806","CVE-2024-58266","CVE-2025-3416","CVE-2025-55159"]},{"id":"SUSE-SU-2025:03077-1","title":"Security update for rav1e","vulnerabilityIds":["CVE-2024-58266"]},{"id":"openSUSE-SU-2025:15433-1","title":"framework-inputmodule-control-0.2.0-3.1 on GA media","vulnerabilityIds":["CVE-2023-53156","CVE-2024-58266"]},{"id":"msrc_CVE-2024-58266","title":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","vulnerabilityIds":["CVE-2024-58266"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-54826","identifiers":["EUVD-2024-54826","CVE-2024-58266"]},"retained":false,"historicalAffected":[]},{"revision":"0686d9efae8249a88396b8a9ab9ffe8f","observedAt":"2026-10-25T01:17:17.137+00:00","statement":{"source":"nvd","id":"CVE-2024-58266","aliases":[],"title":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","description":"The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command injection.","state":0,"publishedAt":"2025-07-27T22:15:25.707+00:00","modifiedAt":"2026-06-17T08:14:44.607+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · cve@mitre.org · Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","score":3.2,"severity":"LOW"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://crates.io/crates/shlex","https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27","https://rustsec.org/advisories/RUSTSEC-2024-0006.html"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58266","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-116"],"productCriteria":["cpe:2.3:a:comex:shlex:*:*:*:*:*:rust:*:*"],"sourceDates":{"published":"2025-07-27T22:15:25.707","lastModified":"2026-06-17T08:14:44.607"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-58266","identifiers":["CVE-2024-58266"]},"retained":false,"historicalAffected":[]},{"revision":"fdc30ed4abb04e29aa0a68908061d5b0","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-r7qv-8r2h-pg27","aliases":["CVE-2024-58266","RUSTSEC-2024-0006"],"title":"Multiple issues involving quote API in shlex","description":"## Issue 1: Failure to quote characters\n\nAffected versions of this crate allowed the bytes `{` and `\\xa0` to appear unquoted and unescaped in command arguments.\n\nIf the output of `quote` or `join` is passed to a shell, then what should be a single command argument could be interpreted as multiple arguments.\n\nThis does not *directly* allow arbitrary command execution (you can't inject a command substitution or similar).  But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution.\n\nThe flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired.\n\nWorkaround: Check for the bytes `{` and `\\xa0` in `quote`/`join` input or output.\n\n(Note: `{` is problematic because it is used for glob expansion.  `\\xa0` is problematic because it's treated as a word separator in [specific environments][solved-xa0].)\n\n## Issue 2: Dangerous API w.r.t. nul bytes\n\nVersion 1.3.0 deprecates the `quote` and `join` APIs in favor of `try_quote` and `try_join`, which behave the same except that they have `Result` return type, returning `Err` if the input contains nul bytes.\n\nStrings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally.  If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios.  [More details here.][nul-bytes]\n\nDue to the low severity, the behavior of the original `quote` and `join` APIs has not changed; they continue to allow nuls.\n\nWorkaround: Manually check for nul bytes in `quote`/`join` input or output.\n\n## Issue 3: Lack of documentation for interactive shell risks\n\nThe `quote` family of functions does not and cannot escape control characters. With non-interactive shells this is perfectly safe, as control characters have no special effect.  But if you writing directly to the standard input of an interactive shell (or through a pty), then control characters [can cause misbehavior including arbitrary command injection.][control-characters]\n\nThis is essentially unfixable, and has not been patched.  But as of version 1.3.0, documentation has been added.\n\nFuture versions of `shlex` may add API variants that avoid the issue at the cost of reduced portability.\n\n[solved-xa0]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#solved-xa0\n[nul-bytes]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#nul-bytes\n[control-characters]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#control-characters-interactive-contexts-only","state":0,"publishedAt":"2024-01-22T21:21:30+00:00","modifiedAt":"2025-07-28T16:42:04.422423+00:00","affected":[{"ecosystem":"crates.io","name":"shlex","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.3.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27","https://nvd.nist.gov/vuln/detail/CVE-2024-58266","https://github.com/comex/rust-shlex","https://rustsec.org/advisories/RUSTSEC-2024-0006.html"],"sourceUrl":"https://github.com/advisories/GHSA-r7qv-8r2h-pg27","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-r7qv-8r2h-pg27","identifiers":["GHSA-r7qv-8r2h-pg27","CVE-2024-58266","RUSTSEC-2024-0006"]},"retained":false,"historicalAffected":[]},{"revision":"1e42095d8a2c47b7aaf18e2c2585412e","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2024-0006","aliases":["CVE-2024-58266","GHSA-r7qv-8r2h-pg27"],"title":"Multiple issues involving quote API","description":"## Issue 1: Failure to quote characters\n\nAffected versions of this crate allowed the bytes `{` and `\\xa0` to appear\nunquoted and unescaped in command arguments.\n\nIf the output of `quote` or `join` is passed to a shell, then what should be a\nsingle command argument could be interpreted as multiple arguments.\n\nThis does not *directly* allow arbitrary command execution (you can't inject a\ncommand substitution or similar).  But depending on the command you're running,\nbeing able to inject multiple arguments where only one is expected could lead\nto undesired consequences, potentially including arbitrary command execution.\n\nThe flaw was corrected in version 1.2.1 by escaping additional characters.\nUpdating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if\ndesired.\n\nWorkaround: Check for the bytes `{` and `\\xa0` in `quote`/`join` input or\noutput.\n\n(Note: `{` is problematic because it is used for glob expansion.  `\\xa0` is\nproblematic because it's treated as a word separator in [specific\nenvironments][solved-xa0].)\n\n## Issue 2: Dangerous API w.r.t. nul bytes\n\nVersion 1.3.0 deprecates the `quote` and `join` APIs in favor of `try_quote`\nand `try_join`, which behave the same except that they have `Result` return\ntype, returning `Err` if the input contains nul bytes.\n\nStrings containing nul bytes generally cannot be used in Unix command arguments\nor environment variables, and most shells cannot handle nul bytes even\ninternally.  If you try to pass one anyway, then the results might be\nsecurity-sensitive in uncommon scenarios.  [More details here.][nul-bytes]\n\nDue to the low severity, the behavior of the original `quote` and `join` APIs\nhas not changed; they continue to allow nuls.\n\nWorkaround: Manually check for nul bytes in `quote`/`join` input or output.\n\n## Issue 3: Lack of documentation for interactive shell risks\n\nThe `quote` family of functions does not and cannot escape control characters.\nWith non-interactive shells this is perfectly safe, as control characters have\nno special effect.  But if you writing directly to the standard input of an\ninteractive shell (or through a pty), then control characters [can cause\nmisbehavior including arbitrary command injection.][control-characters]\n\nThis is essentially unfixable, and has not been patched.  But as of version\n1.3.0, documentation has been added.\n\nFuture versions of `shlex` may add API variants that avoid the issue at the\ncost of reduced portability.\n\n[solved-xa0]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#solved-xa0\n[nul-bytes]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#nul-bytes\n[control-characters]: https://docs.rs/shlex/latest/shlex/quoting_warning/index.html#control-characters-interactive-contexts-only","state":0,"publishedAt":"2024-01-21T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:05.1158536+00:00","affected":[{"ecosystem":"crates.io","name":"shlex","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"1.3.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/shlex","https://rustsec.org/advisories/RUSTSEC-2024-0006.html","https://github.com/comex/rust-shlex/commit/4a0724b0b62ef715467875b040a890ce75a8a829"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0006","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2024-0006","identifiers":["RUSTSEC-2024-0006","CVE-2024-58266","GHSA-r7qv-8r2h-pg27"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4268898+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4268987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T10:21:22.8157744+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8157744+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T10:21:50.2500014+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4276529+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4276532+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b0b0499af228434598651aa5d221386e","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T10:21:49.6403901+00:00","lastSuccessAt":"2026-11-10T10:21:49.637+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T10:21:49.637+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T10:21:23.1241572+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1241572+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T10:21:22.8858542+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8858542+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T10:21:23.1397622+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1397622+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T10:21:23.0142877+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.0142877+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}