VulnerabilityRUSTSEC-2026-0257 · webbrowser

RUSTSEC-2026-0257: Unix `BROWSER` handling allows browser argument injection

Short answerA security vulnerability in the webbrowser crate: Unix `BROWSER` handling allows browser argument injection. No severity score was published. Fixed in 1.2.2: update to a fixed version.

Crate	webbrowser
Type	Vulnerability (format-injection)
Affected versions	Before 1.2.2.
Fixed in	1.2.2
Severity	not scored
Published	2026-07-29
Last changed	2026-10-12
Also known as	GHSA-2ph8-5cr8-hr33
Affected functions	`webbrowser::open`, `webbrowser::open_browser`, `webbrowser::open_browser_with_options`

What to do

See which version you have: cargo tree -i webbrowser (it also shows which of your dependencies pulls it in).
Update within your version requirement: cargo update -p webbrowser. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example webbrowser = "1.2.2") or update the dependency that pulls it in.
Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split_ascii_whitespace(). If an application passes an attacker-controlled non-HTTP(S) URL whose parsed form retains spaces and the effective BROWSER template contains %s, text that should remain within one URL argument becomes additional browser arguments.

The issue was reproduced with Chromium by injecting --remote-debugging-port, which exposed a local DevTools endpoint, and --proxy-server, which redirected browser traffic through an attacker-controlled proxy. The available arguments and resulting impact depend on the browser launched by the affected application.

Version 1.2.2 fixes the issue by tokenizing the BROWSER template before substituting the URL, preserving the URL as part of a single argument. Users should upgrade to version 1.2.2 or later. Applications that only need HTTP(S) URLs can also enable the crate's hardened feature as defense in depth.

This issue was reported by @dywzju09-blip.

References

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for webbrowser

VulnerabilityGHSA-m589-mv4q-p7rj · 2023-01-13webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL

Full security history of webbrowser

Up next

Same cratewebbrowser: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →

Also worth your time

Did this answer your question?