PT-2025-26609 · Xdg-Utils+1 · Xdg-Utils+1

Mingi Jung · Published 2025-06-23 · Updated 2025-06-24 · CVE-2025-52968

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: xdg-utils versions 1.1.0 through 1.2.1 xdg-utils version 1.2.1

Description: The issue concerns xdg-open in xdg-utils, which can send requests containing SameSite=Strict cookies. This can facilitate Cross-Site Request Forgery (CSRF) attacks. The problem is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user or resulted from navigation from content in an untrusted origin.

Recommendations: For xdg-utils versions 1.1.0 through 1.2.1, consider modifying xdg-open to associate x-scheme-handler/https with the execution of a browser using command-line options that arrange for an empty cookie store, although this would add substantial complexity and may not be desirable for all users. For xdg-utils version 1.2.1, as a temporary workaround, consider restricting the use of xdg-open to minimize the risk of CSRF attacks until a more suitable solution is available.

Fix

Weakness Enumeration

CWE-420

Related Identifiers

AZL-64296

CVE-2025-52968

ECHO-39BC-1319-217C

Affected Products

Debian

Xdg-Utils

References · 14

• https://osv.dev/vulnerability/CVE-2025-52968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52968 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-52968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52968 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-52968 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-64296 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-52968 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-52968 · Vendor Advisory
• https://twitter.com/NotADrX_1943/status/1937253931995775108 · Twitter Post
• https://twitter.com/CVEnew/status/1937174988903399512 · Twitter Post
• https://openwall.com/lists/oss-security/2025/06/23/1 · Note
• https://twitter.com/VulmonFeeds/status/1937171213685526589 · Twitter Post
• https://cgit.freedesktop.org/xdg/xdg-utils/tag/?h=v1.2.1 · Note
• https://t.me/cvetracker/26847 · Telegram Post