shlex
Activity
- Latest release
- 3mo ago
- Total releases
- 9
- Cadence
- ~6 months
- Last 12 months
- 2
Details
- License
- MIT OR Apache-2.0
- First release
- Jun 22, 2015
| Version | Released | |
|---|---|---|
2.0.1
unknown
|
2.0.1
unknown
|
|
2.0.0
unknown
|
2.0.0
unknown
|
|
1.3.0
unknown
|
1.3.0
unknown
|
|
1.2.1
unknown
1 CVE
CVE-2024-58266
GHSA-r7qv-8r2h-pg27
RUSTSEC-2024-0006
Jan 22, 2024
Multiple issues involving quote API in shlex
3.2
/ 10
Low
Local
High
None
None
Changed
None
Low
None
Issue 1: Failure to quote charactersAffected versions of this crate allowed the bytes If the output of This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution. The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired. Workaround: Check for the bytes (Note: Issue 2: Dangerous API w.r.t. nul bytesVersion 1.3.0 deprecates the Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here. Due to the low severity, the behavior of the original Workaround: Manually check for nul bytes in Issue 3: Lack of documentation for interactive shell risksThe This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added. Future versions of Fixed in
1.3.0
References Updated Jul 28, 2025 · Source: OSV.dev |
1.2.1
unknown
|
|
1.2.0
unknown
1 CVE
CVE-2024-58266
GHSA-r7qv-8r2h-pg27
RUSTSEC-2024-0006
Jan 22, 2024
Multiple issues involving quote API in shlex
3.2
/ 10
Low
Local
High
None
None
Changed
None
Low
None
Issue 1: Failure to quote charactersAffected versions of this crate allowed the bytes If the output of This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution. The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired. Workaround: Check for the bytes (Note: Issue 2: Dangerous API w.r.t. nul bytesVersion 1.3.0 deprecates the Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here. Due to the low severity, the behavior of the original Workaround: Manually check for nul bytes in Issue 3: Lack of documentation for interactive shell risksThe This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added. Future versions of Fixed in
1.3.0
References Updated Jul 28, 2025 · Source: OSV.dev |
1.2.0
unknown
|
|
1.1.0
unknown
1 CVE
CVE-2024-58266
GHSA-r7qv-8r2h-pg27
RUSTSEC-2024-0006
Jan 22, 2024
Multiple issues involving quote API in shlex
3.2
/ 10
Low
Local
High
None
None
Changed
None
Low
None
Issue 1: Failure to quote charactersAffected versions of this crate allowed the bytes If the output of This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution. The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired. Workaround: Check for the bytes (Note: Issue 2: Dangerous API w.r.t. nul bytesVersion 1.3.0 deprecates the Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here. Due to the low severity, the behavior of the original Workaround: Manually check for nul bytes in Issue 3: Lack of documentation for interactive shell risksThe This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added. Future versions of Fixed in
1.3.0
References Updated Jul 28, 2025 · Source: OSV.dev |
1.1.0
unknown
|
|
1.0.0
unknown
1 CVE
CVE-2024-58266
GHSA-r7qv-8r2h-pg27
RUSTSEC-2024-0006
Jan 22, 2024
Multiple issues involving quote API in shlex
3.2
/ 10
Low
Local
High
None
None
Changed
None
Low
None
Issue 1: Failure to quote charactersAffected versions of this crate allowed the bytes If the output of This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution. The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired. Workaround: Check for the bytes (Note: Issue 2: Dangerous API w.r.t. nul bytesVersion 1.3.0 deprecates the Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here. Due to the low severity, the behavior of the original Workaround: Manually check for nul bytes in Issue 3: Lack of documentation for interactive shell risksThe This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added. Future versions of Fixed in
1.3.0
References Updated Jul 28, 2025 · Source: OSV.dev |
1.0.0
unknown
|
|
0.1.1
unknown
1 CVE
CVE-2024-58266
GHSA-r7qv-8r2h-pg27
RUSTSEC-2024-0006
Jan 22, 2024
Multiple issues involving quote API in shlex
3.2
/ 10
Low
Local
High
None
None
Changed
None
Low
None
Issue 1: Failure to quote charactersAffected versions of this crate allowed the bytes If the output of This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution. The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired. Workaround: Check for the bytes (Note: Issue 2: Dangerous API w.r.t. nul bytesVersion 1.3.0 deprecates the Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here. Due to the low severity, the behavior of the original Workaround: Manually check for nul bytes in Issue 3: Lack of documentation for interactive shell risksThe This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added. Future versions of Fixed in
1.3.0
References Updated Jul 28, 2025 · Source: OSV.dev |
0.1.1
unknown
|
|
0.1.0
unknown
1 CVE
CVE-2024-58266
GHSA-r7qv-8r2h-pg27
RUSTSEC-2024-0006
Jan 22, 2024
Multiple issues involving quote API in shlex
3.2
/ 10
Low
Local
High
None
None
Changed
None
Low
None
Issue 1: Failure to quote charactersAffected versions of this crate allowed the bytes If the output of This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on the command you're running, being able to inject multiple arguments where only one is expected could lead to undesired consequences, potentially including arbitrary command execution. The flaw was corrected in version 1.2.1 by escaping additional characters. Updating to 1.3.0 is recommended, but 1.2.1 offers a more minimal fix if desired. Workaround: Check for the bytes (Note: Issue 2: Dangerous API w.r.t. nul bytesVersion 1.3.0 deprecates the Strings containing nul bytes generally cannot be used in Unix command arguments or environment variables, and most shells cannot handle nul bytes even internally. If you try to pass one anyway, then the results might be security-sensitive in uncommon scenarios. More details here. Due to the low severity, the behavior of the original Workaround: Manually check for nul bytes in Issue 3: Lack of documentation for interactive shell risksThe This is essentially unfixable, and has not been patched. But as of version 1.3.0, documentation has been added. Future versions of Fixed in
1.3.0
References Updated Jul 28, 2025 · Source: OSV.dev |
0.1.0
unknown
|