Multiple issues involving quote API in shlex
Issue 1: Failure to quote characters Affected versions of this crate allowed the bytes { and \xa0 to appear unquoted and unescaped in command arguments. If the output of quote or join is passed to a shell, then what should be a single command argument could be interpreted as multiple arguments. This does not directly allow arbitrary command execution (you can't inject a command substitution or similar). But depending on …