CVE-2024-43402: Rust is a programming language

Q: How do I fix CVE-2024-43402?

rust: upgrade to 1.81.0. Exact commands for each OS are on this page.

Q: Is CVE-2024-43402 being exploited?

CVE-2024-43402 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2024-43402 affect?

CVE-2024-43402 affects rust. Severity is high (CVSS 8.1). Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix wh

This month

HIGH 8.1UPGRADE

CVE-2024-43402 is a high-severity flaw (CVSS 8.1) affecting rust. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	8.1 (High)
Attack vector	Local
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	0.7% (top 45%)
CISA exploited list	No
Weakness	CWE-78, CWE-88
Published	2024-09-04
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: rust-lang

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-09-04 16:15 UTCPublished CVE record published
2026-06-17 07:50 UTCUpdated Record last modified

rust-lang rust UPGRADE

Affected: < 1.81.0

Fixed in: 1.81.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy rust || rpm -q rust || rust --version

2. UPGRADE to 1.81.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade rust

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade rust

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-43402?

rust: upgrade to 1.81.0. Exact commands for each OS are on this page.

Is CVE-2024-43402 being exploited?

CVE-2024-43402 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-43402 affect?

CVE-2024-43402 affects rust. Severity is high (CVSS 8.1). Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix wh

How urgent is CVE-2024-43402?

Priority 42/100. High severity

Software pages

Windows vulnerabilities

Related CVEs

CVE-2024-3566 CRITICAL 9.8 UPGRADE UPGRADE A command inject vulnerability allows an attacker to perform command injection on Windows applications that in
CVE-2024-24576 CRITICAL 10.0 MITIGATE UPGRADE Rust is a programming language
CVE-2023-40030 MEDIUM 6.1 UPGRADE Cargo downloads a Rust project’s dependencies and compiles the project
CVE-2022-21658 HIGH 7.3 UPGRADE MITIGATE Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially
CVE-2021-31162 CRITICAL 9.8 UPGRADE MITIGATE In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freei

References

← Back to latest CVEs