UpHeron
All vulnerabilities

Servers and applications

CVE-2024-24576

`std::process::Command` did not properly escape arguments of batch files on Windows

Severity
Critical 10.0
Published
9 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.77.2
Also known as
GHSA-q455-m56c-85mh
Sources
NVD, Project advisories (GitHub)

Description

Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping.…

Affected software

SoftwareAffected versions
RustServers and applications · cpe:a:rust-lang:rust
  • Every version before 1.77.2
RustServers and applications · github:rust-lang/rust
  • Every version before 1.77.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-24576
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-24576
  • GitHub Advisory Database https://github.com/advisories/GHSA-q455-m56c-85mh
  • github.com https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh