rustsec-2026-0257

debian_rustsec
Description

On Unix platforms handled by `src/unix.rs`, affected versions substitute the caller-supplied URL into the `BROWSER` environment-variable template before tokenizing the resulting string with `split_ascii_whitespace()`. If an application passes an attacker-controlled non-HTTP(S) URL whose parsed form retains spaces and the effective `BROWSER` template contains `%s`, text that should remain within one URL argument becomes additional browser arguments. The issue was reproduced with Chromium by injecting `--remote-debugging-port`, which exposed a local DevTools endpoint, and `--proxy-server`, which redirected browser traffic through an attacker-controlled proxy. The available arguments and resulting impact depend on the browser launched by the affected application. Version 1.2.2 fixes the issue by tokenizing the `BROWSER` template before substituting the URL, preserving the URL as part of a single argument. Users should upgrade to version 1.2.2 or later. Applications that only need HTTP(S) URLs can also enable the crate's `hardened` feature as defense in depth. This issue was reported by [@dywzju09-blip](https://github.com/dywzju09-blip).

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": [
    "GHSA-2ph8-5cr8-hr33"
  ],
  "categories": [
    "format-injection"
  ],
  "crate": "webbrowser",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-07-29",
  "deb_packages": [
    {
      "crate_name": null,
      "deb_name": "tree-sitter-cli",
      "version": "0.26.11-1"
    }
  ],
  "description": "On Unix platforms handled by `src/unix.rs`, affected versions substitute the\ncaller-supplied URL into the `BROWSER` environment-variable template before\ntokenizing the resulting string with `split_ascii_whitespace()`. If an\napplication passes an attacker-controlled non-HTTP(S) URL whose parsed form\nretains spaces and the effective `BROWSER` template contains `%s`, text that\nshould remain within one URL argument becomes additional browser arguments.\n\nThe issue was reproduced with Chromium by injecting\n`--remote-debugging-port`, which exposed a local DevTools endpoint, and\n`--proxy-server`, which redirected browser traffic through an\nattacker-controlled proxy. The available arguments and resulting impact depend\non the browser launched by the affected application.\n\nVersion 1.2.2 fixes the issue by tokenizing the `BROWSER` template before\nsubstituting the URL, preserving the URL as part of a single argument. Users\nshould upgrade to version 1.2.2 or later. Applications that only need HTTP(S)\nURLs can also enable the crate's `hardened` feature as defense in depth.\n\nThis issue was reported by\n[@dywzju09-blip](https://github.com/dywzju09-blip).",
  "id": "RUSTSEC-2026-0257",
  "keywords": [
    "argument-injection",
    "browser",
    "unix"
  ],
  "patched_versions": [
    ">=1.2.2"
  ],
  "source": "debian_rustsec",
  "title": "Unix `BROWSER` handling allows browser argument injection",
  "url": "https://github.com/amodm/webbrowser-rs/commit/31d1b924885551c0e553909d27c738ca6958a0f3"
}
View JSON API Download JSON