| title | author | author_site | author_image | excerpt |
|---|---|---|---|---|
Nushell 0.92.2 (hot-fix) |
The Nu Authors |
Today, we're releasing version 0.92.2 of Nu. This release fixes a security vulnerability present in 0.92.1 on Windows. |
Nushell, or Nu for short, is a new shell that takes a modern, structured approach to your command line. It works seamlessly with the data from your filesystem, operating system, and a growing number of file formats to make it easy to build powerful command line pipelines.
Today, we're releasing version 0.92.2 of Nu, a hotfix release for 0.92.1. This hot-fix addresses a security concern with how arguments are passed to external commands on Windows.
The underlying vulnerability was found in the interaction of the Rust standard library we use and the Windows command invocation logic and documented as CVE-2024-24576. For further reading:
- CVE-2024-24576 on the Rust blog
- the writeup on the BatBadBut bug, exposed by @ryotkak of Flatt Security.
To address this concern we have updated the version of the Rust compiler and standard library used to build Nushell to the latest stable version (1.77.2).
::: warning Distributors of Nushell also need to upgrade their Rust toolchain to provide a Nushell build with the patch included. :::
For convenience, we are providing full patched builds for Windows, Linux, and macOS. Be sure you have the requirements to enable all capabilities.
Nu 0.92.2 is available as pre-built binaries or from crates.io. If you have Rust installed you can install it using cargo install nu.
::: tip Note
The optional dataframe functionality is available by cargo install nu --features=dataframe.
:::
As part of this release, we also publish a set of optional plugins you can install and use with Nu. To install, use cargo install nu_plugin_<plugin name>.