CVE-2025-52968: xdg-utils <=1.2.1 xdg-open CSRF via SameSite=Strict
CVE-2025-52968 Published on June 23, 2025
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.
Weakness Type
Unprotected Alternate Channel
The software protects a primary channel, but it does not use the same level of protection for an alternate channel.
Products Associated with CVE-2025-52968
Want to know whenever a new CVE is published for FreeDesktop Xdg Utils? stack.watch will email you.
Affected Versions
freedesktop xdg-utils:- Before and including 1.2.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.