CVE-2017-18266: High severity Freedesktop xdg-utils vulnerability
Last updated 25 August 2025
Other sources
The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-18266?
CVE-2017-18266 is a vulnerability in xdg-utils before version 1.1.3 that allows remote attackers to conduct argument-injection attacks via a crafted URL.
What is the severity of CVE-2017-18266?
CVE-2017-18266 has a severity rating of 8.8 (high).
How does CVE-2017-18266 affect xdg-utils?
CVE-2017-18266 affects xdg-utils versions before 1.1.3.
How can I fix CVE-2017-18266?
To fix CVE-2017-18266, update xdg-utils to version 1.1.3 or later.
Where can I find more information about CVE-2017-18266?
You can find more information about CVE-2017-18266 at the following references: [Link 1](https://bugs.freedesktop.org/show_bug.cgi?id=103807), [Link 2](https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2), [Link 3](https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb).