CVE-2017-17514

8.8 highEPSS 1.7%

High (8.8). EPSS 1.7% chance of exploitation in the next 30 days.

boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER environment variable

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2017-12-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
nip2_project:nip2

References

https://github.com/jcupitt/nip2/issues/70
https://security-tracker.debian.org/tracker/CVE-2017-17514
https://github.com/jcupitt/nip2/issues/70
https://security-tracker.debian.org/tracker/CVE-2017-17514

Check your stack JSON