---
id: RUSTSEC-2026-0257
aliases:
  - GHSA-2ph8-5cr8-hr33
title: Unix `BROWSER` handling allows browser argument injection
summary: Unix `BROWSER` handling allows browser argument injection
severity: none
vendor: webbrowser
product: webbrowser
ecosystem: rust
affected:
  - 'webbrowser >= 0.0.0-0, < 1.2.2'
patched:
  - webbrowser 1.2.2
published: '2026-07-29'
updated: '2026-08-12'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0257'
references:
  - url: 'https://crates.io/crates/webbrowser'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0257.html'
  - url: >-
      https://github.com/amodm/webbrowser-rs/security/advisories/GHSA-2ph8-5cr8-hr33
  - url: >-
      https://github.com/amodm/webbrowser-rs/commit/31d1b924885551c0e553909d27c738ca6958a0f3
  - url: 'https://github.com/amodm/webbrowser-rs/releases/tag/v1.2.2'
tags:
  - osv
  - rust
ingestedAt: '2026-08-12T19:18:09.039Z'
---

## Overview

On Unix platforms handled by `src/unix.rs`, affected versions substitute the
caller-supplied URL into the `BROWSER` environment-variable template before
tokenizing the resulting string with `split_ascii_whitespace()`. If an
application passes an attacker-controlled non-HTTP(S) URL whose parsed form
retains spaces and the effective `BROWSER` template contains `%s`, text that
should remain within one URL argument becomes additional browser arguments.

The issue was reproduced with Chromium by injecting
`--remote-debugging-port`, which exposed a local DevTools endpoint, and
`--proxy-server`, which redirected browser traffic through an
attacker-controlled proxy. The available arguments and resulting impact depend
on the browser launched by the affected application.

Version 1.2.2 fixes the issue by tokenizing the `BROWSER` template before
substituting the URL, preserving the URL as part of a single argument. Users
should upgrade to version 1.2.2 or later. Applications that only need HTTP(S)
URLs can also enable the crate's `hardened` feature as defense in depth.

This issue was reported by
[@dywzju09-blip](https://github.com/dywzju09-blip).

## Affected packages

- `webbrowser >= 0.0.0-0, < 1.2.2`

## Remediation

Upgrade to a patched release:

- `webbrowser 1.2.2`