CVE-2024-24576: Rust Batch File Command Injection

CVE-2024-24576 identifies a critical vulnerability in Rust standard library versions prior to 1.77.2. The flaw concerns the argument escaping mechanism when invoking batch files (.bat and .cmd) on Windows using the Command API. If an attacker can control the arguments passed to the spawned process, arbitrary shell commands can be executed by bypassing the escaping protections. This vulnerability affects Windows systems exclusively and only scenarios where batch files are invoked with untrusted arguments.

Severity is critical with a CVSS score of 10.0, the maximum on the vulnerability scale. The flaw exists in the escaping code that, due to the complexity of cmd.exe (batch file interpreter), was not sufficiently robust. The fix has been available since Rust 1.77.2 (February 2024). Recently (6 November 2026), a GitHub signal indicates an offline model for testing batch file quoting behavior, suggesting continued community attention to the flaw over time.

For defense: 1) immediately verify the version of Rust in use on Windows systems; 2) if version < 1.77.2 and code invokes batch files with external data, update Rust immediately; 3) analyze application code to identify all points where untrusted arguments are passed to batch files and evaluate alternative mitigations; 4) if upgrade is not immediately feasible, the CommandExt::raw_arg API allows bypassing standard library escaping, but only if arguments come from a trusted source. It is not recommended in scenarios with untrusted data.