{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"xdg-utils","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NP0R0XAVMNZVAP0RY65X8C","modified_at":"2026-09-01T20:05:53.802477845Z","published_at":"2025-06-23T15:15:29.350Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-52968","https://security-tracker.debian.org/tracker/CVE-2025-52968"],"severity":{"label":"low","score":2.7},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-52968#Debian:14/xdg-utils","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-52968"}],"summary":"xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler"}