High severity8.8OSV Advisory· Published Dec 14, 2017· Updated Jun 17, 2026
CVE-2017-17522
CVE-2017-17522
Description
Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3v0.9.8, v0.9.9, v1.0.1, …+ 2 more
- (no CPE)range: v0.9.8, v0.9.9, v1.0.1, …
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*range: <=3.6.3
- (no CPE)range: <=3.6.3
Patches
Vulnerability mechanics
References
3- www.securityfocus.com/bid/102207nvdThird Party AdvisoryVDB Entry
- security-tracker.debian.org/tracker/CVE-2017-17522nvdIssue TrackingThird Party Advisory
- bugs.python.org/issue32367nvd
News mentions
0No linked articles in our index yet.