{"answers":{"affected":"1 open source package ship an affected version, including webbrowser.","exploited":"There is no known exploitation of RUSTSEC-2026-0257 in the wild and no public exploit code.","fix":"Upgrade webbrowser to 1.2.2 or later.","what":"RUSTSEC-2026-0257 is a command injection vulnerability in webbrowser, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0257 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0257 is a command injection vulnerability in webbrowser, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of RUSTSEC-2026-0257 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- webbrowser (crates.io): affected from 0.0.0-0; fixed in 1.2.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0257/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0257/index.md)","id":"RUSTSEC-2026-0257","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0257/index.md","name":"RUSTSEC-2026-0257","record":{"aliases":["GHSA-2ph8-5cr8-hr33"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust browser library","requires_auth":"none","summary":"Attacker-controlled URLs can inject browser arguments via BROWSER env var, enabling traffic redirection or remote debugging access.","user_interaction":"required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On Unix platforms handled by `src/unix.rs`, affected versions substitute the\ncaller-supplied URL into the `BROWSER` environment-variable template before\ntokenizing the resulting string with `split_ascii_whitespace()`. If an\napplication passes an attacker-controlled non-HTTP(S) URL whose parsed form\nretains spaces and the effective `BROWSER` template contains `%s`, text that\nshould remain within one URL argument becomes additional browser arguments.\n\nThe issue was reproduced with Chromium by injecting\n`--remote-debugging-port`, which exposed a local DevTools endpoint, and\n`--proxy-server`, which redirected browser traffic through an\nattacker-controlled proxy. The available arguments and resulting impact depend\non the browser launched by the affected application.\n\nVersion 1.2.2 fixes the issue by tokenizing the `BROWSER` template before\nsubstituting the URL, preserving the URL as part of a single argument. Users\nshould upgrade to version 1.2.2 or later. Applications that only need HTTP(S)\nURLs can also enable the crate's `hardened` feature as defense in depth.\n\nThis issue was reported by\n[@dywzju09-blip](https://github.com/dywzju09-blip).","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Unix `BROWSER` handling allows browser argument injection","id":"RUSTSEC-2026-0257","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["1.2.2"],"introduced":["0.0.0-0"],"last_affected":[],"package":"webbrowser","purl":"pkg:cargo/webbrowser","source":"RUSTSEC-2026-0257"}],"products":null,"published":"2026-07-29","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attacker-controlled URLs can inject browser arguments via BROWSER env var, enabling traffic redirection or remote debugging access.","url":"https://insights.sbomify.com/RUSTSEC-2026-0257/"}