rustsec-2026-0257
Vulnerability from osv_rustsec
Published
2026-07-29 12:00
Modified
2026-08-12 10:42
Summary
Unix `BROWSER` handling allows browser argument injection
Details

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split_ascii_whitespace(). If an application passes an attacker-controlled non-HTTP(S) URL whose parsed form retains spaces and the effective BROWSER template contains %s, text that should remain within one URL argument becomes additional browser arguments.

The issue was reproduced with Chromium by injecting --remote-debugging-port, which exposed a local DevTools endpoint, and --proxy-server, which redirected browser traffic through an attacker-controlled proxy. The available arguments and resulting impact depend on the browser launched by the affected application.

Version 1.2.2 fixes the issue by tokenizing the BROWSER template before substituting the URL, preserving the URL as part of a single argument. Users should upgrade to version 1.2.2 or later. Applications that only need HTTP(S) URLs can also enable the crate's hardened feature as defense in depth.

This issue was reported by @dywzju09-blip.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "format-injection"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "webbrowser::open",
            "webbrowser::open_browser",
            "webbrowser::open_browser_with_options"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "webbrowser",
        "purl": "pkg:cargo/webbrowser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "1.2.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-2ph8-5cr8-hr33"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "On Unix platforms handled by `src/unix.rs`, affected versions substitute the\ncaller-supplied URL into the `BROWSER` environment-variable template before\ntokenizing the resulting string with `split_ascii_whitespace()`. If an\napplication passes an attacker-controlled non-HTTP(S) URL whose parsed form\nretains spaces and the effective `BROWSER` template contains `%s`, text that\nshould remain within one URL argument becomes additional browser arguments.\n\nThe issue was reproduced with Chromium by injecting\n`--remote-debugging-port`, which exposed a local DevTools endpoint, and\n`--proxy-server`, which redirected browser traffic through an\nattacker-controlled proxy. The available arguments and resulting impact depend\non the browser launched by the affected application.\n\nVersion 1.2.2 fixes the issue by tokenizing the `BROWSER` template before\nsubstituting the URL, preserving the URL as part of a single argument. Users\nshould upgrade to version 1.2.2 or later. Applications that only need HTTP(S)\nURLs can also enable the crate\u0027s `hardened` feature as defense in depth.\n\nThis issue was reported by\n[@dywzju09-blip](https://github.com/dywzju09-blip).",
  "id": "RUSTSEC-2026-0257",
  "modified": "2026-08-12T10:42:29Z",
  "published": "2026-07-29T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/webbrowser"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0257.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/amodm/webbrowser-rs/security/advisories/GHSA-2ph8-5cr8-hr33"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amodm/webbrowser-rs/commit/31d1b924885551c0e553909d27c738ca6958a0f3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amodm/webbrowser-rs/releases/tag/v1.2.2"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Unix `BROWSER` handling allows browser argument injection"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.