Unix `BROWSER` handling allows browser argument injection

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

On Unix platforms handled by `src/unix.rs`, affected versions substitute the caller-supplied URL into the `BROWSER` environment-variable template before tokenizing the resulting string with `split_ascii_whitespace()`. If an application passes an attacker-controlled non-HTTP(S) URL whose parsed form retains spaces and the effective `BROWSER` template contains `%s`, text that should remain within one URL argument becomes additional browser arguments. The issue was reproduced with Chromium by injecting `--remote-debugging-port`, which exposed a local DevTools endpoint, and `--proxy-server`, which redirected browser traffic through an attacker-controlled proxy. The available arguments and resulting impact depend on the browser launched by the affected application. Version 1.2.2 fixes the issue by tokenizing the `BROWSER` template before substituting the URL, preserving the URL as part of a single argument. Users should upgrade to version 1.2.2 or later. Applications that only need HTTP(S) URLs can also enable the crate's `hardened` feature as defense in depth. This issue was reported by [@dywzju09-blip](https://github.com/dywzju09-blip).

Source published

29 Jul 2026 12:00:00 UTC

Source modified

12 Oct 2026 18:00:10 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.