Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-58266

33
FAUCET Score

CVE-2024-58266 is a critical command injection vulnerability affecting the Rust shlex crate before version 1.2.1. It allows attackers to inject commands due to improper handling of unquoted and unescaped '{' and non-breaking space characters. With a CVSS score of 9.8, this vulnerability presents a severe risk, enabling unauthenticated remote attackers to achieve full compromise of confidentiality, integrity, and availability with low attack complexity. While no public exploits, Metasploit modules, or Nuclei templates are currently available, and there is no evidence of active exploitation or community discussion, the high CVSS score warrants immediate patching.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.2.1CPE matchmatch criteria
cpe:2.3:a:comex:shlex:*:*:*:*:*:rust:*:*
>= 0, < 1.2.1CPE match
cpe:2.3:a:comex:shlex:*:*:*:*:*:rust:*:*

CVSS Data

CVSS version used by this source: 3.1

3.2LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
1.4
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.78%
Probability of exploitation in next 30 days
EPSS Percentile
52.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0078 is in the 36th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (30)

microsoftpatch availablevia msrc
Product: 20257-17084
microsoftpatch availablevia msrc
Product: azl3 rust 1.86.0-3 on Azure Linux 3.0
rustpatch availablevia ghsa
Product: shlexFixed in: 1.3.0
github_advisoryvendor investigatingvia nvd_reference
View patch
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/eventrouter-rhel9
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/log-file-metric-exporter-rhel9
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/vector-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-cni-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-must-gather-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-pilot-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-proxyv2-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-sail-operator-bundle
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: gjs
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: thunderbird
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: thunderbird
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: firefox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: gjs
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: keylime-agent-rust
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: polkit
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: stratisd
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: thunderbird
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: conmon-rs
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: kata-containers
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/cluster-logging-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/cluster-logging-operator-bundle

Vendor Advisories (3)

redhatCVE-2024-58266Low

shlex: Shlex Command Injection Vulnerability

Jul 27, 2025
microsoft2025-Jul/CVE-2024-58266

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

Jul 8, 2025
rustGHSA-r7qv-8r2h-pg27low

Multiple issues involving quote API in shlex

Jan 22, 2024

References

crates.io / crates/shlex
Product
github.com / comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27
Vendor Advisory
rustsec.org / advisories/RUSTSEC-2024-0006.html
Third Party Advisory