Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks

A critical command injection vulnerability (CVE-2024-24576, "BatBadBut") in the Rust standard library improperly escaped arguments when invoking Windows batch files, allowing an attacker controlling spawn arguments to execute arbitrary shell commands; it affects Rust < 1.77.2, carries a CVSS 10.0 rating, can impact other language runtimes that wrap CreateProcess, and maintainers (including Haskell, Node.js, PHP and yt-dlp) have released patches.