Rust-lang vulnerabilities
We track 6 vulnerabilities in Rust-lang products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2024.
Latest Rust-lang vulnerabilities
- 8.8 High severity
rust: Improper Neutralization of Argument Delimiters in a Command
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file na
- 9.8 Critical severity
Node.js: Improper Neutralization of Special Elements used in a Command
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
- 10.0 Critical severity
rust: Improper Neutralization of Special Elements used in an OS Command
Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`.
- 7.3 High severity
cargo: Incorrect Permission Assignment for Critical Resource
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate co
- 8.1 High severity
cargo: Improper Link Resolution Before File Access
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo wr
- 7.5 High severity
regex: Inefficient Regular Expression Complexity
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations