GHSA-286m-6pg9-v42v: Duplicate Advisory: Multiple issues involving quote API in shlex

The vulnerability exists in the shlex crate because the quote and join functions failed to properly escape special shell characters, specifically { and non-breaking space (\xa0). This could allow an attacker to craft input that, when processed by these functions and executed by a shell, would be interpreted as multiple command-line arguments instead of a single one. This could lead to command injection if the calling application is not careful about how it uses the output.

The analysis of the patch between version 1.2.0 and the minimally patched version 1.2.1 (commit 4c53044f62ba3e0921b6283e8ae37f7039c23643) clearly shows the fix. The patch modifies the shlex::bytes::quote function, which contains the core quoting logic, to recognize {, }, and a range of Unicode characters (including \xa0) as needing to be quoted. The public-facing functions shlex::quote and shlex::join in src/lib.rs both rely on this underlying function, so they were both vulnerable and are now fixed. Any runtime profile of an exploitation attempt would likely show calls to shlex::quote and/or shlex::join, which in turn call shlex::bytes::quote.