CVE-2024-58266

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

VendorProductVersions
comexshlex< 1.2.1

References

Timeline

Published
Jul 27, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-582678.0A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishCVE-2024-582694.3A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and regisCVE-2024-58279.8Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL traiCVE-2024-582737.8Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute CVE-2024-582748.3Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /CVE-2024-582758.7Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers CVE-2024-582768.7Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated CVE-2024-582778.7R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enCVE-2024-582788.5perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scriptCVE-2024-582798.8appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP filCVE-2024-58289.8Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects HiCVE-2024-582808.8CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload mal