Description (CNA)
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| comex / shlex | affected 0 before 1.2.1 |
CWE
CWE-116
References
- https://rustsec.org/advisories/RUSTSEC-2024-0006.html
- https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27
- https://crates.io/crates/shlex
ADP enrichment
No English description supplied.
No references supplied.