CVE-2022-45299

webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL

9.8 CriticalPublic exploitFix available

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.36%Unchanged since Jan 14, 2023

What each source reports

NVD Score used 9.8

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: CVE-2022-45299
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

CVE List 9.8

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: CVE-2022-45299
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2023-0503 9.8

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: EUVD-2023-0503
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m589-mv4q-p7rj 9.8

webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: GHSA-m589-mv4q-p7rj
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSV 9.8

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: CVE-2022-45299
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-m589-mv4q-p7rj 9.8

webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: GHSA-m589-mv4q-p7rj
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-45299 9.8

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: UBUNTU-CVE-2022-45299
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-45299 No score

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

Record: DEBIAN-CVE-2022-45299
Updated: 2026-11-03

OSVopenSUSE-SU-2024:12620-1 No score

libtree-sitter0-0.20.7-2.1 on GA media

These are all security issues fixed in the libtree-sitter0-0.20.7-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12620-1
Updated: 2026-11-02

Affected products

webbrowser project webbrowser

Affected packages

Affected packages
Package	Affected	Fixed
`webbrowser` crates.io	before 0.8.3	0.8.3
`rust-webbrowser` Debian:13	before 0.8.7-1	0.8.7-1
`rust-webbrowser` Debian:14	before 0.8.7-1	0.8.7-1
`rust-webbrowser` Ubuntu:20.04:LTS	All versions, plus listed versions 0.5.2-10.5.2-2	None known
`rust-webbrowser` Ubuntu:22.04:LTS	All versions, plus listed versions 0.5.2-2	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	offalltn/CVE-2022-45299	2023-01-13

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45299 is a critical vulnerability (CVSS 9.8) in Webbrowser Project Webbrowser, published January 13, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in webbrowser 0.8.3.

References

Show 5 moreShow less