CVE-2017-17522 describes an argument-injection vulnerability in Python's webbrowser.py module (through version 3.6.3). It allows remote attackers to execute arbitrary commands via a crafted URL due to insufficient validation of the BROWSER environment variable. This vulnerability is rated as High severity (CVSS 8.8), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to high confidentiality, integrity, and availability impacts. Despite the high severity, a software maintainer suggests exploitation is impossible due to the default shell=False setting in subprocess.Popen, and there is no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.6.3CPE matchmatch criteria | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
CVE-2017-17522
Dec 10, 2024CVE-2017-17522
Nov 12, 2024CVE-2017-17522
Oct 8, 2024CVE-2017-17522
Aug 11, 2020python: Command injection in Lib/webbrowser.py
Dec 14, 2017Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting
Dec 12, 2017