CVE-2024-51756

The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code. cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted filesystem paths could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them provide access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports. The bug is fixed in #371, which is published in cap-primitives 3.4.1, cap-std 3.4.1, and cap-async-std 3.4.1. There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.

• CWE-22

• https://en.wikipedia.org/wiki/ISO/IEC_8859-1
• https://github.com/bytecodealliance/cap-std/commit/dcc3818039761331fbeacbb3a40c542b65b5ebf7
• https://github.com/bytecodealliance/cap-std/pull/371
• https://github.com/bytecodealliance/cap-std/security/advisories/GHSA-hxf5-99xg-86hw
• https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions

Published

Nov 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51750Element is a Matrix web client built using the Matrix React …5
• CVE-2024-51751Gradio is an open-source Python package designed to enable q…6.5
• CVE-2024-51752The AuthKit library for Next.js provides convenient helpers …5.5
• CVE-2024-51753The AuthKit library for Remix provides convenient helpers fo…2.1
• CVE-2024-51754Twig is a template language for PHP. In a sandbox, an attack…2.2
• CVE-2024-51755Twig is a template language for PHP. In a sandbox, an attack…2.2
• CVE-2024-51757happy-dom is a JavaScript implementation of a web browser wi…9.3
• CVE-2024-51758Filament is a collection of full-stack components for accele…2.3
• CVE-2024-51759Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-5176Insufficiently Protected Credentials vulnerability in Baxter…9.4
• CVE-2024-51760Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-51761Improper Neutralization of Input During Web Page Generation …7.1