Arbitrary Command Injection Affecting diesel package, versions <2.3.8
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Command Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-DIESEL-16689164
- published14 May 2026
- disclosed24 Apr 2026
- creditUnknown
Introduced: 24 Apr 2026
New CVE NOT AVAILABLE CWE-77 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade diesel to version 2.3.8 or higher.
Overview
diesel is an extensible ORM and Query Builder for Rust.
Affected versions of this package are vulnerable to Arbitrary Command Injection in the handling of user-supplied options for PostgreSQL COPY FROM and COPY TO statements. An attacker can manipulate the configuration of these statements by injecting quote characters into the options, potentially altering the behavior of the database operation.