Disclosure summary
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
Source-reported weakness categories
CWE-116
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
Microsoft Security Updates (CVRF) · 2025-Jul
Open original source · Updated Sep 08, 2026
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.
Microsoft maximum product score: 3.2
| Vendor | Product / association | Version / bounds |
|---|---|---|
| Microsoft update guide | cbl2 kata-containers 3.2.0.azl2-6 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 kata-containers-cc 3.2.0.azl2-7 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 rust 1.72.0-10 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-17 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.86.0-3 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-18 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 rust 1.72.0-10 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-21 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-22 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-24 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-25 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 rust 1.72.0-15 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-27 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-28 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-29 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 kata-containers 3.2.0.azl2-7 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 kata-containers-cc 3.2.0.azl2-8 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | azl3 rust 1.75.0-20 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 rust 1.72.0-11 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 rust 1.72.0-13 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 rust 1.72.0-14 on CBL Mariner 2.0 | (MSRC status code 3) |
Vendor remediation references
- CBL-Mariner Releases · product IDs 20257-17084
- Vendor guidance · product IDs 20257-17084
Original records & references
- NIST NVD record
- CVE Program record
- msrc.microsoft.com — Vendor advisory
PUBLISHED 2025-09-03T23:03:00-04:00
MODIFIED 2026-09-08T21:45:50-04:00
INGESTED 2026-10-08T12:45:45-04:00