CSRF Vulnerability in xdg-utils: SameSite Cookie Exposure
Summary
CVE-2025-52968: xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. Affects xdg-utils versions 1.1.3-4.1 – 1.2.1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xdg-utils is a set of scripts that help applications integrate with the desktop environment in Linux systems. It provides a standardized way to open files and URLs in the user's preferred applications. The package is widely used across various Linux distributions, including Debian. The vulnerability in question allows for the potential exposure of SameSite=Strict cookies, which could lead to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability identified as CVE-2025-52968 arises from the xdg-open command in xdg-utils version 1.2.1. It can send requests that include SameSite=Strict cookies, which may facilitate CSRF attacks. This issue is particularly concerning as it could allow malicious actors to exploit the command-line options of xdg-open to manipulate browser behavior, potentially leading to unauthorized actions on behalf of the user. The dispute surrounding this vulnerability stems from the fact that typical integrations of xdg-open do not disclose whether the command was executed manually by a user or triggered by untrusted content.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using xdg-open for opening URLs from untrusted sources. Instead, manually copy and paste URLs into a trusted browser to mitigate the risk of CSRF attacks.
Conclusion
The vulnerability CVE-2025-52968 in xdg-utils presents a significant risk due to its potential to facilitate CSRF attacks through SameSite=Strict cookies. Users are encouraged to update their xdg-utils package to the latest version to mitigate this risk. Additionally, utilizing workarounds can help protect against potential exploitation until a fix is applied.
See every vulnerability recorded for xdg-utils →
FAQ
CVE-2025-52968 is a vulnerability in xdg-utils that allows for the potential exposure of SameSite=Strict cookies, which can facilitate CSRF attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
SameSite cookies are a web security feature that helps prevent CSRF attacks by controlling how cookies are sent with cross-site requests.
If you cannot update xdg-utils, consider using a workaround by avoiding the use of xdg-open for untrusted URLs and manually opening them in a secure browser.
While the vulnerability poses a risk, its impact may vary based on how xdg-open is integrated into applications. It is advisable to apply fixes or workarounds promptly.
Related vulnerabilities
Recent vulnerabilities recorded for xdg-utils.
