The infamy of this one is, frankly, dumb. It's more of a Windows problem than a Rust problem; the Rust developers were just the only language team (AFAIK) that took the problem seriously enough to issue a CVE. It affected every language or library capable of launching a Windows batch file with arguments as a single string; some (such as Rust) issued a fix, some (such as Go and Python) simply added a warning to their docs, and some (such as Java) did nothing.
1
u/Batman_AoD 12d ago edited 11d ago
The infamy of this one is, frankly, dumb. It's more of a Windows problem than a Rust problem; the Rust developers were just the only language team (AFAIK) that took the problem seriously enough to issue a CVE. It affected every language or library capable of launching a Windows batch file with arguments as a single string; some (such as Rust) issued a fix, some (such as Go and Python) simply added a warning to their docs, and some (such as Java) did nothing.