Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

webbrowser

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Unix BROWSER handling allows browser argument injection

    GHSA-2ph8-5cr8-hr33

    Affected
    • crates.io webbrowser >= 0.0.0-0, < 1.2.2
    Fixed in
    1.2.2· Vendor fix available
    Issue
    On Unix platforms handled by `src/unix.rs`, affected versions substitute the caller-supplied URL into the `BROWSER` environment-variable template before tokenizing the resulting string with `split_ascii_whitespace()`. If an application passes an attacker-controlled non-HTTP(S) URL whose parsed form retains spaces and the effective `BROWSER` template contains `%s`, text that should remain within one URL argument becomes additional browser arguments. The issue was reproduced with Chromium by injecting `--remote-debugging-port`, which exposed a local DevTools endpoint, and `--proxy-server`, which redirected browser traffic through an attacker-controlled proxy. The available arguments and resulting impact depend on the browser launched by the affected application. Version 1.2.2 fixes the issue by tokenizing the `BROWSER` template before substituting the URL, preserving the URL as part of a single argument. Users should upgrade to version 1.2.2 or later. Applications that only need…

    Recommended action: Upgrade to 1.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →
  2. Critical, CVSS 9.8crates.ioPublished

    webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL

    CVE-2022-45299 · GHSA-m589-mv4q-p7rj

    Affected
    • crates.io webbrowser < 0.8.3
    Fixed in
    0.8.3· Vendor fix available
    Issue
    An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.

    Recommended action: Upgrade to 0.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →