{"id":"GHSA-2rxc-gjrp-vjhx","aliases":["RUSTSEC-2024-0404"],"status":"published","title":"Unsoundness in anstream","description":"When given a valid UTF8 string \"ö\\x1b😀\", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \\xc3\\xb6 then \\x1b then \\xf0\\x9f\\x98\\x80.\n\nWhen looping over \"non-printable bytes\" \\x1b\\xf0 will be considered as some non-printable sequence.\n\nThis will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.\n\nFull credit goes to @Ralith who reviewed this code and asked @burakemir to follow up.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-09-08T12:00:00Z","modified":"2026-09-10T03:50:21Z","fixes":[{"ecosystem":"crates.io","package":"anstream","fixed_in":["0.6.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"anstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.8"}]}]},{"source":"osv","ecosystem":"crates.io","package":"anstream","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.8"}]}]},{"source":"osv","ecosystem":"crates.io","package":"anstream","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.8"}]}]}],"references":[{"url":"https://github.com/rust-cli/anstyle/issues/156","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0404.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2rxc-gjrp-vjhx"},{"url":"https://github.com/rust-cli/anstyle","tags":["package"]},{"url":"https://crates.io/crates/anstream","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2rxc-gjrp-vjhx","title":"Unsoundness in anstream","description":"When given a valid UTF8 string \"ö\\x1b😀\", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \\xc3\\xb6 then \\x1b then \\xf0\\x9f\\x98\\x80.\n\nWhen looping over \"non-printable bytes\" \\x1b\\xf0 will be considered as some non-printable sequence.\n\nThis will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.\n\nFull credit goes to @Ralith who reviewed this code and asked @burakemir to follow up.","status":"published","published":"2024-12-04T18:31:31Z","modified":"2024-12-04T18:31:33Z","updated_at":"2026-11-02T14:38:24.542211Z"}],"osv":[{"id":"GHSA-2rxc-gjrp-vjhx","title":"Unsoundness in anstream","description":"When given a valid UTF8 string \"ö\\x1b😀\", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \\xc3\\xb6 then \\x1b then \\xf0\\x9f\\x98\\x80.\n\nWhen looping over \"non-printable bytes\" \\x1b\\xf0 will be considered as some non-printable sequence.\n\nThis will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.\n\nFull credit goes to @Ralith who reviewed this code and asked @burakemir to follow up.","status":"published","published":"2024-12-04T18:31:31Z","modified":"2026-09-10T03:50:21.162155425Z","updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"RUSTSEC-2024-0404","title":"Unsoundness in anstream","description":"When given a valid UTF8 string \"ö\\x1b😀\", the function in\ncrates/anstream/src/adapter/strip.rs will be confused. The UTF8\nbytes are \\xc3\\xb6 then \\x1b then \\xf0\\x9f\\x98\\x80.\n\nWhen looping over \"non-printable bytes\" \\x1b\\xf0 will be\nconsidered as some non-printable sequence.\n\nThis will produce a broken str from the incorrectly segmented\nbytes via str::from_utf8_unchecked, and that should never happen.\n\nFull credit goes to [@Ralith](https://github.com/Ralith) who reviewed this code and\nasked [@burakemir](https://github.com/burakemir) to follow up.","status":"published","published":"2024-09-08T12:00:00Z","modified":"2026-07-17T16:00:04.561210538Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}