Description
Cross-site scripting (XSS) vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-251 w3m - missing HTML quoting Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-249 w3mmee - missing HTML quoting Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:045 vendor-advisory
- 6793 vdb-entry
- 8031 third-party-advisory
- http://mi.med.tohoku.ac.jp/~satodai/w3m-dev-en/200211.month/838.html
- OpenPKG-SA-2003.009 vendor-advisory
- 8015 third-party-advisory
- 8016 third-party-advisory
- 6981 vdb-entry
- DSA-251 vendor-advisory
- RHSA-2003:044 vendor-advisory
- 8053 third-party-advisory
- w3m-html-frame-xss(10842) vdb-entry
- DSA-249 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=124484
- DSA-250 vendor-advisory