Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2024-58266

critical

CVE-2024-58266

shlex: Shlex Command Injection Vulnerability

Published Modified CWE 116
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA3.2CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Red Hat3.2CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (low), Red Hat (low), Azure Linux (low).

Description

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

Affected packages and fixed versions

SourcePackageFixed in
Azure Linux 3.0rust0:1.86.0-3.azl3
cargo::GitHub Security Advisory Rustshlex1.3.0
debian 10rust-shlexno fix listed
debian 11rust-shlexno fix listed
debian 12rust-shlexno fix listed
debian 13rust-shlex1.3.0-1
debian 14rust-shlex1.3.0-1
echorust-shlex1.3.0-1
rapidfort alma 10firefox, gjs, gjs-devel and 1 moreno fix listed
rapidfort alma 8firefox, thunderbirdno fix listed
rapidfort alma 9firefox, firefox-x11, gjs and 6 moreno fix listed
rapidfort debian 12rust-shlex0:1.3.0-1
Show all 70 entries from 22 sources
SourcePackageFixed in
Azure Linux 3.0rust0:1.86.0-3.azl3
cargo::GitHub Security Advisory Rustshlex1.3.0
debian 10rust-shlexno fix listed
debian 11rust-shlexno fix listed
debian 12rust-shlexno fix listed
debian 13rust-shlex1.3.0-1
debian 14rust-shlex1.3.0-1
echorust-shlex1.3.0-1
rapidfort alma 10firefoxno fix listed
rapidfort alma 10gjsno fix listed
rapidfort alma 10gjs-develno fix listed
rapidfort alma 10thunderbirdno fix listed
rapidfort alma 8firefoxno fix listed
rapidfort alma 8thunderbirdno fix listed
rapidfort alma 9firefoxno fix listed
rapidfort alma 9firefox-x11no fix listed
rapidfort alma 9gjsno fix listed
rapidfort alma 9gjs-develno fix listed
rapidfort alma 9keylime-agent-rustno fix listed
rapidfort alma 9stratisdno fix listed
rapidfort alma 9stratisd-dracutno fix listed
rapidfort alma 9stratisd-toolsno fix listed
rapidfort alma 9thunderbirdno fix listed
rapidfort debian 12rust-shlex0:1.3.0-1
rapidfort debian 13rust-shlex0:1.3.0-1
rapidfort fedora 43firefox158.0.1-3.fc43
rapidfort fedora 43gjs1.86.0-3.fc43
rapidfort fedora 43gjs-devel1.86.0-3.fc43
rapidfort fedora 43thunderbird158.0-4.fc43
rapidfort Oracle Linux 10firefoxno fix listed
rapidfort Oracle Linux 10gjsno fix listed
rapidfort Oracle Linux 10gjs-develno fix listed
rapidfort Oracle Linux 10thunderbirdno fix listed
rapidfort Oracle Linux 9firefoxno fix listed
rapidfort Oracle Linux 9firefox-x11no fix listed
rapidfort Oracle Linux 9gjsno fix listed
rapidfort Oracle Linux 9gjs-develno fix listed
rapidfort Oracle Linux 9keylime-agent-rustno fix listed
rapidfort Oracle Linux 9thunderbirdno fix listed
rapidfort Red Hat 10firefoxno fix listed
rapidfort Red Hat 10gjsno fix listed
rapidfort Red Hat 10gjs-develno fix listed
rapidfort Red Hat 10thunderbirdno fix listed
rapidfort Red Hat 9firefoxno fix listed
rapidfort Red Hat 9gjsno fix listed
rapidfort Red Hat 9gjs-develno fix listed
rapidfort Red Hat 9thunderbirdno fix listed
rapidfort rocky 10firefoxno fix listed
rapidfort rocky 10gjsno fix listed
rapidfort rocky 10gjs-develno fix listed
rapidfort rocky 10thunderbirdno fix listed
rapidfort rocky 8firefoxno fix listed
rapidfort rocky 8thunderbirdno fix listed
rapidfort rocky 9firefoxno fix listed
rapidfort rocky 9firefox-x11no fix listed
rapidfort rocky 9gjsno fix listed
rapidfort rocky 9gjs-develno fix listed
rapidfort rocky 9keylime-agent-rustno fix listed
rapidfort rocky 9thunderbirdno fix listed
Red Hatconmon-rsno fix listed
Red Hatfirefoxno fix listed
Red Hatfirefox-x11no fix listed
Red Hatgjsno fix listed
Red Hatgjs-develno fix listed
Red Hatkata-containersno fix listed
Red Hatkeylime-agent-rustno fix listed
Red Hatstratisdno fix listed
Red Hatstratisd-dracutno fix listed
Red Hatstratisd-toolsno fix listed
Red Hatthunderbirdno fix listed

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.