Browser Argument Injection Vulnerability in webbrowser Package
Summary
RUSTSEC-2026-0257: Unix BROWSER handling allows browser argument injection. Affects webbrowser versions >= 0.0.0-0, < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The webbrowser package is a Rust library that provides a simple interface for opening URLs in a web browser. It allows developers to launch the default web browser with specified URLs, making it easier to integrate web interactions into Rust applications. However, the package has a vulnerability that affects its handling of the BROWSER environment variable on Unix platforms, potentially allowing for argument injection when non-HTTP(S) URLs are used.
Vulnerability Detail
On Unix platforms, the webbrowser package improperly substitutes user-supplied URLs into the BROWSER environment variable template before tokenizing the string. This can lead to a situation where spaces in a non-HTTP(S) URL are interpreted as additional arguments for the browser, allowing an attacker to inject malicious commands. For instance, an attacker could exploit this by injecting arguments like '--remote-debugging-port', which could expose sensitive browser functionalities, or '--proxy-server', redirecting traffic through an attacker-controlled proxy. The vulnerability was identified in versions prior to 1.2.2, and it poses significant risks depending on the browser being launched.
How To Fix
Minimum fixed version
1.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider using the crate's 'hardened' feature, which can be enabled in your Cargo.toml file as follows: 'webbrowser = { version = "^1.2.2", features = ["hardened"] }'. This provides an additional layer of defense against potential exploitation.
Conclusion
The webbrowser package has a significant vulnerability that allows for browser argument injection on Unix platforms. Users are strongly advised to upgrade to version 1.2.2 or later to mitigate this risk. Additionally, utilizing the 'hardened' feature can provide further protection until an upgrade is feasible.
See every vulnerability recorded for webbrowser →
FAQ
The vulnerability allows for browser argument injection due to improper handling of the BROWSER environment variable on Unix platforms.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
An attacker could inject malicious browser arguments, potentially exposing sensitive functionalities or redirecting traffic through malicious proxies.
Yes, the vulnerability is fixed in version 1.2.2 of the webbrowser package. Users should upgrade to this version or later.
Consider enabling the 'hardened' feature in the webbrowser package as a temporary workaround to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for webbrowser.
