{"action":"Upgrade webbrowser to 1.2.2 or later.","affected":[{"fixed":"1.2.2","introduced":"0.0.0-0"}],"component":"webbrowser","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["1.2.2"],"ghsa_id":"GHSA-2ph8-5cr8-hr33","id":"tcs_01M5KFC2NMY30EZQDVVGJ6RN7V","modified_at":"2026-10-12T18:00:10.938749232Z","published_at":"2026-07-29T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0257","https://crates.io/crates/webbrowser","https://rustsec.org/advisories/RUSTSEC-2026-0257.html","https://github.com/amodm/webbrowser-rs/commit/31d1b924885551c0e553909d27c738ca6958a0f3","https://github.com/amodm/webbrowser-rs/releases/tag/v1.2.2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0257","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0257"}],"summary":"Unix `BROWSER` handling allows browser argument injection"}