GitHub Advisoryadvisory · PyPI

GHSA-336h-q7mh-8vf8 Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks

HIGH Published 2022-05-14 Modified 2024-04-22 Official page ↗
Aliases
CVE-2017-17516
Ecosystem
PyPI
Packages
rtv
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2024-04-22

Affected packages

• PyPI rtv: <= 1.19.0 (no fix yet)

Description

scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

Related

Alias · CVE (1)

  • CVE-2017-17516 scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References