Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affecting webbrowser package, versions <1.2.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-WEBBROWSER-19424705
- published29 Aug 2026
- disclosed29 Jul 2026
- creditUnknown
Introduced: 29 Jul 2026
CVE NOT AVAILABLE CWE-74 (opens in a new tab)How to fix?
Upgrade webbrowser to version 1.2.2 or higher.
Overview
webbrowser is a package for opening URLs in web browsers
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the webbrowser::open, webbrowser::open_browser, or webbrowser::open_browser_with_options functions. An attacker can inject arbitrary browser arguments by supplying a specially crafted URL containing spaces when the BROWSER environment variable template includes %s, potentially leading to unintended browser behavior such as exposing local debugging endpoints or redirecting traffic through an attacker-controlled proxy.