CVE-2024-58266 — Improper Encoding or Escaping of Output in Shlex

CWE-116 — Improper Encoding or Escaping of Output8 documents6 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 78.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Comex ShlexDebian Rust-shlexMsrc Azl3 Rust 1.75.0-17 ON Azure Linux 3.0+17 more
Timeline
PublishedJul 27

Description

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages21 packages

▶debiandebian/rust-shlex< rust-shlex 1.3.0-1 (forky)
▶NVDcomex/shlex< 1.2.1
▶crates.iocomex/shlex0.0.0-0 — 1.3.0+1

🔴Vulnerability Details

4
OSV
CVE-2024-58266: The shlex crate before 1↗2025-07-27
▶
OSV
Multiple issues involving quote API in shlex↗2024-01-22
▶
GHSA
Multiple issues involving quote API in shlex↗2024-01-22
▶
OSV
Multiple issues involving quote API↗2024-01-21
▶

📋Vendor Advisories

3
Red Hat
shlex: Shlex Command Injection Vulnerability↗2025-07-27
▶
Microsoft
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.↗2025-07-08
▶
Debian
CVE-2024-58266: rust-shlex - The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of...↗2024
▶
CVE-2024-58266 — Comex Shlex vulnerability | cvebase