UpHeron
All vulnerabilities

Servers and applications

CVE-2024-43402

`std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods

Severity
High 8.8
Published
4 Sept 2024
Last changed
17 Jun 2026
Added to UpHeron
22 Oct 2026
Fixed in
1.81.0
Also known as
GHSA-2xg3-7mm6-98jj
Sources
NVD, Project advisories (GitHub)

Description

Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping…

Affected software

SoftwareAffected versions
RustServers and applications · cpe:a:rust-lang:rust
  • Every version before 1.81.0
RustServers and applications · github:rust-lang/rust
  • Every version before 1.81.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-43402
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-43402
  • GitHub Advisory Database https://github.com/advisories/GHSA-2xg3-7mm6-98jj
  • github.com https://github.com/rust-lang/rust/security/advisories/GHSA-2xg3-7mm6-98jj