Critical CSRF Vulnerability in xdg-utils Package
Summary
DEBIAN-CVE-2025-52968: xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. Affects xdg-utils versions 1.1.3-4.1 – 1.2.1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xdg-utils is a set of command-line tools that assist in integrating desktop applications with the desktop environment. It provides utilities for opening files and URLs in the user's preferred applications, managing desktop entries, and more. The package is widely used in various Linux distributions, including Debian. However, a vulnerability has been identified in the xdg-open utility, which can lead to security risks if exploited.
Vulnerability Detail
The vulnerability arises from the xdg-open utility in xdg-utils versions up to 1.2.1, which can send requests containing SameSite=Strict cookies. This behavior can facilitate Cross-Site Request Forgery (CSRF) attacks, allowing malicious actors to exploit the user's session. The issue is compounded by the fact that integrations of xdg-open typically do not disclose whether the command was executed manually by the user or triggered by untrusted content, increasing the risk of exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using xdg-open for opening URLs from untrusted sources. Instead, manually copy and paste the URLs into your browser to prevent potential CSRF attacks.
Conclusion
The xdg-utils package has a vulnerability in the xdg-open utility that can lead to CSRF attacks due to the handling of SameSite cookies. Users are advised to update their packages to mitigate this risk and consider workarounds until an update can be applied.
See every vulnerability recorded for xdg-utils →
FAQ
The vulnerability allows xdg-open to send requests with SameSite=Strict cookies, which can lead to CSRF attacks.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
As a workaround, avoid using xdg-open for URLs from untrusted sources and manually open links in your browser.
While the urgency is classified as unimportant, it can still pose a risk if exploited in specific scenarios.
You can find detailed information in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-52968.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for xdg-utils.
