CVE-2017-18266

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment…

published May 10, 2018

CVSS
—
EPSS
2%
Percentile
83.8
In the wild
Unconfirmed
What it is

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02399 · 83.8th percentile
Published
2018-05-10T14:00Z
EPSS history
Timeline
  • 10 MAY 14:00Z
    The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment…
    cvelistv5