Bash Replacement - Rust Scripts

Posted Dec 7, 2024 15:36 UTC (Sat) by smcv (subscriber, #53363)
In reply to: Bash Replacement - Rust Scripts by ma4ris8
Parent article: Abusing Git branch names to compromise a PyPI package

If you can inject arbitrary code into a template that is subsequently run as a script (as in this particular vulnerability), it doesn't really matter whether it's arbitrary shell execution, arbitrary Rust execution, or any other language like Python or Lua - arbitrary code is arbitrary code.

Shell script makes it very hard to avoid *other* vulnerabilities, but *this* vulnerability wasn't a shell problem.