Rust addresses critical vulnerability on Windows

Interesting how this has been widely reported as a Rust issue but the fact that other languages have no patches yet or do not even plan to patch it has seen little attention.

This is the best summary I could come up with:

Programmers are being urged to update their Rust versions after the security experts working on the language addressed a critical vulnerability that could lead to malicious command injections on Windows machines.

It affects the Rust standard library, which was found to be improperly escaping arguments when invoking batch files on Windows using the Command API.

"An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping," said Pietro Albini of the Rust Security Response Working Group, who wrote the advisory.

The language is a fan favorite, routinely topping Stack Overflow's rankings for how enjoyable developers find Rust to use in their work, and Googlers hail its productivity benefits.

According to RyotaK, the researcher who reported the vulnerability, which they are referring to as BatBadBut due to it revolving around batch files and its severity – "bad, but not the worst" – the issue affects more technologies than Rust alone.

RyotaK also made the point that users should not jump to conclusions based on the CVSS rating alone, since the severity of the issue will depend on each application individually and should be recalculated as such.

The original article contains 552 words, the summary contains 195 words. Saved 65%. I'm a bot and I'm open source!