---
id: CVE-2017-17512
title: >-
  sensible-browser in sensible-utils before 0.0.11 does not validate strings
  before launching the program specified by the BROWSER environment variable,
  which allows remote attackers to conduct argument-injection attacks via a
  crafted URL,…
summary: >-
  sensible-browser in sensible-utils before 0.0.11 does not validate strings
  before launching the program specified by the BROWSER environment variable,
  which allows remote attackers to conduct argument-injection attacks via a
  crafted URL,…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-74
vendor: sensible-utils_project
product: sensible-utils
affected:
  - sensible-utils < 0.0.11
patched:
  - sensible-utils 0.0.11
published: '2017-12-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:39.930'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-17512'
references:
  - url: >-
      http://metadata.ftp-master.debian.org/changelogs/main/s/sensible-utils/sensible-utils_0.0.11_changelog
    label: cve@mitre.org
  - url: 'https://bugs.debian.org/881767'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2017/12/msg00012.html'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/3584-1/'
    label: cve@mitre.org
  - url: 'https://www.debian.org/security/2017/dsa-4071'
    label: cve@mitre.org
  - url: >-
      http://metadata.ftp-master.debian.org/changelogs/main/s/sensible-utils/sensible-utils_0.0.11_changelog
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugs.debian.org/881767'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2017/12/msg00012.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/3584-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2017/dsa-4071'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.02355
epssPercentile: 0.8346
ingestedAt: '2026-10-14T07:21:04.798Z'
---

## Overview

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.

## Affected

- `sensible-utils < 0.0.11`

## Remediation

Upgrade past the affected range:

- `sensible-utils 0.0.11`