{"id":"GHSA-2ph8-5cr8-hr33","aliases":["RUSTSEC-2026-0257"],"status":"published","title":"Unix `BROWSER` handling allows browser argument injection","description":"On Unix platforms handled by `src/unix.rs`, affected versions substitute the\ncaller-supplied URL into the `BROWSER` environment-variable template before\ntokenizing the resulting string with `split_ascii_whitespace()`. If an\napplication passes an attacker-controlled non-HTTP(S) URL whose parsed form\nretains spaces and the effective `BROWSER` template contains `%s`, text that\nshould remain within one URL argument becomes additional browser arguments.\n\nThe issue was reproduced with Chromium by injecting\n`--remote-debugging-port`, which exposed a local DevTools endpoint, and\n`--proxy-server`, which redirected browser traffic through an\nattacker-controlled proxy. The available arguments and resulting impact depend\non the browser launched by the affected application.\n\nVersion 1.2.2 fixes the issue by tokenizing the `BROWSER` template before\nsubstituting the URL, preserving the URL as part of a single argument. Users\nshould upgrade to version 1.2.2 or later. Applications that only need HTTP(S)\nURLs can also enable the crate's `hardened` feature as defense in depth.\n\nThis issue was reported by\n[@dywzju09-blip](https://github.com/dywzju09-blip).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-29T12:00:00Z","modified":"2026-10-12T18:00:10Z","fixes":[{"ecosystem":"crates.io","package":"webbrowser","fixed_in":["1.2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"webbrowser","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.2.2"}]}]}],"references":[{"url":"https://crates.io/crates/webbrowser","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0257.html","tags":["advisory"]},{"url":"https://github.com/amodm/webbrowser-rs/commit/31d1b924885551c0e553909d27c738ca6958a0f3","tags":["web"]},{"url":"https://github.com/amodm/webbrowser-rs/releases/tag/v1.2.2","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0257","title":"Unix `BROWSER` handling allows browser argument injection","description":"On Unix platforms handled by `src/unix.rs`, affected versions substitute the\ncaller-supplied URL into the `BROWSER` environment-variable template before\ntokenizing the resulting string with `split_ascii_whitespace()`. If an\napplication passes an attacker-controlled non-HTTP(S) URL whose parsed form\nretains spaces and the effective `BROWSER` template contains `%s`, text that\nshould remain within one URL argument becomes additional browser arguments.\n\nThe issue was reproduced with Chromium by injecting\n`--remote-debugging-port`, which exposed a local DevTools endpoint, and\n`--proxy-server`, which redirected browser traffic through an\nattacker-controlled proxy. The available arguments and resulting impact depend\non the browser launched by the affected application.\n\nVersion 1.2.2 fixes the issue by tokenizing the `BROWSER` template before\nsubstituting the URL, preserving the URL as part of a single argument. Users\nshould upgrade to version 1.2.2 or later. Applications that only need HTTP(S)\nURLs can also enable the crate's `hardened` feature as defense in depth.\n\nThis issue was reported by\n[@dywzju09-blip](https://github.com/dywzju09-blip).","status":"published","published":"2026-07-29T12:00:00Z","modified":"2026-10-12T18:00:10.938749232Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}