CVE-2024-58266 is a low severity (CVSS 3.2) flaw in the Rust shlex crate. Before version 1.2.1, the quote and join functions left the characters open brace and byte 0xA0 unescaped, which can turn one shell argument into several. Upgrade to 1.3.0, which RustSec recommends, or 1.2.1 for a minimal fix.
What's affected
The affected package is the shlex crate on crates.io, which provides shell-style splitting and quoting for Rust programs. RustSec lists these functions as affected in versions below 1.2.1: shlex::quote, shlex::join, shlex::bytes::quote and shlex::bytes::join.
The NVD record says versions before 1.2.1. RustSec marks 1.3.0 and later as patched and says updating to 1.3.0 is recommended, while 1.2.1 offers a smaller fix if you cannot take the larger change. The project changelog describes 1.2.1 as a partial fix and 1.3.0 as the full fix for the same advisory, which is also published as RUSTSEC-2024-0006 and GHSA-r7qv-8r2h-pg27.
Note that 1.3.0 adds new try_ quoting functions and deprecates the older ones, so you may see deprecation warnings after the upgrade. Version 2.0.0 removes the deprecated functions entirely, which is a breaking change.
How to check if you're exposed
Because shlex is a library, most projects pull it in through another crate. Find every copy in your dependency graph:
cargo tree -i shlex
cargo audit
The first command shows which crates depend on shlex and at which version. The second checks your lockfile against the RustSec database, where this issue appears as RUSTSEC-2024-0006. If you vendor your dependencies, grep the vendored directory for the crate name and read the version in its manifest.
Then search your own code for calls to quote or join from shlex that build a command line string passed to a shell. If your code only uses shlex to split input, or passes arguments directly to a process without a shell, the practical exposure is lower.
What to do now
- Run cargo tree for shlex and list each version in your lockfile.
- Update to shlex 1.3.0 or later with cargo update for the crate, or pin to 1.2.1 if you need the smaller fix.
- Rebuild and run your tests, and check for deprecation warnings from the older quote functions.
- Move any code that builds shell command strings toward passing an argument list directly to the process API.
- Run cargo audit in CI so a future advisory on any dependency fails the build.
Why it matters
The bug is an escaping gap. A quoting function is supposed to guarantee that its output is read by a shell as exactly one word. Here, two characters slipped through unescaped, so a value containing them could be read as more than one argument.
The advisory is careful about the limits. It says this does not directly allow arbitrary command execution, since an attacker cannot inject command substitution through it, but that extra arguments could lead to unwanted behavior depending on the command. That is why the score is low: the attack is local, complexity is high, and impact is limited to integrity.
The weakness class is CWE-116: Improper Encoding or Escaping of Output. The CVSS vector in the record is CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N, which scores 3.2. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this give an attacker command execution?
Not directly, according to the RustSec advisory. It lets one argument be read as several, which can matter depending on the program being run.
Which version should I choose?
RustSec recommends 1.3.0. Version 1.2.1 is a smaller fix if a larger upgrade is hard.
Sources
Last reviewed: 19 October 2026.
