Windows Command Escape Vulnerability - Critical CVE ... or is it?

Critical! ... or is it?

CVE-2024-24576 is a freshly reported 10/10 critical CVE affecting Rust, Python, and many other programming languages on Windows that, if exploited, can allow a malicious user to execute arbitrary code as the current user. The 10/10 rating is the worst severity that can be given to a CVE. However, of 9 affected programming languages, 5 have chosen to either not fix the CVE or fix it only by updating their documentation. Let's take a look at this vulnerability, which appears to take advantage of programming languages improperly escaping arguments while creating sub-processes, understand how it's performed, and see why so many languages are choosing not to fix it.

― mCoding with James Murphy (https://mcoding.io)

Source code: https://github.com/mCodingLLC/VideosSampleCode
Python discussion: https://discuss.python.org/t/is-python-affected-by-cve-2024-24576/50740/1
NIST CVE details: https://nvd.nist.gov/vuln/detail/CVE-2024-24576
Rust advisory: https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html
Subprocess docs: https://docs.python.org/3/library/subprocess.html
Subprocess source: https://github.com/python/cpython/blob/main/Lib/subprocess.py...