The vulnerability identified as CVE-2024-58266 concerns the shlex crate used in Rust programming, specifically versions before 1.2.1. It allows unquoted and unescaped occurrences of the { and non-breaking space (\xa0) characters, which may enable command injection attacks. Affected products include Microsoft Azure Linux and CBL Mariner versions 2.0 and 3.0. The vulnerability is categorized under CWE-116 (Improper Encoding or Escaping of Output). There is no CVSS score or detailed vendor advisory available, and no patch information has been provided.

The vulnerability could potentially allow command injection due to improper handling of certain characters in the shlex crate. This may lead to unauthorized command execution in affected environments. However, no known exploits have been reported in the wild, and the exact impact depends on the context in which the vulnerable crate is used within the affected Microsoft products.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Microsoft Security Response Center advisories for updates. Avoid using vulnerable versions of the shlex crate where possible until a fix is confirmed.