RUSTSEC-2026-0257

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0257

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0257.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0257

Aliases

GHSA-2ph8-5cr8-hr33

Published

2026-07-29T12:00:00Z

Modified

2026-08-12T10:45:03.401638412Z

Summary

Unix `BROWSER` handling allows browser argument injection

Details

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split_ascii_whitespace(). If an application passes an attacker-controlled non-HTTP(S) URL whose parsed form retains spaces and the effective BROWSER template contains %s, text that should remain within one URL argument becomes additional browser arguments.

The issue was reproduced with Chromium by injecting --remote-debugging-port, which exposed a local DevTools endpoint, and --proxy-server, which redirected browser traffic through an attacker-controlled proxy. The available arguments and resulting impact depend on the browser launched by the affected application.

Version 1.2.2 fixes the issue by tokenizing the BROWSER template before substituting the URL, preserving the URL as part of a single argument. Users should upgrade to version 1.2.2 or later. Applications that only need HTTP(S) URLs can also enable the crate's hardened feature as defense in depth.

This issue was reported by @dywzju09-blip.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / webbrowser

Package

Name: webbrowser; View open source insights on deps.dev
Purl: pkg:cargo/webbrowser

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

1.2.2

Ecosystem specific

{
    "affects": {
        "os": [],
        "functions": [
            "webbrowser::open",
            "webbrowser::open_browser",
            "webbrowser::open_browser_with_options"
        ],
        "arch": []
    },
    "affected_functions": null
}

Database specific

source

"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0257.json"

informational

null