CVE-2017-17512: High severity Sensible-utils Project Sensible-utils vulnerability
Last updated 25 August 2025
Other sources
sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sensible-utilsto a version that resolves this vulnerability.Fixed in 0.0.17+nmu1Fixed in 0.0.25Fixed in 0.0.26
Event History
Frequently Asked Questions
Which installations are affected?
sensible-utils versions before 0.0.11 are affected. The issue is in sensible-browser when it launches the program named by the BROWSER environment variable.
What does an attacker need to exploit this?
An attacker needs to cause a crafted URL to be handled by sensible-browser. Exploitation relies on the BROWSER environment variable specifying a program invocation that receives the crafted URL without string validation; the supplied CVSS vector also indicates user interaction is required.
How can I determine whether my environment is exposed?
Check whether the installed sensible-utils version is earlier than 0.0.11, and inspect workflows that invoke sensible-browser with URLs originating from remote or otherwise untrusted sources. Also check whether BROWSER is set in the relevant execution environment.