Description
w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-251 w3m - missing HTML quoting Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-249 w3mmee - missing HTML quoting Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:045 vendor-advisory
- DSA-251 vendor-advisory
- RHSA-2003:044 vendor-advisory
- DSA-249 vendor-advisory
- DSA-250 vendor-advisory
- 20030217 GLSA: w3m mailing-list
- http://sourceforge.net/project/shownotes.php?release_id=126233
- w3m-img-alt-xss(11266) vdb-entry
- 6794 vdb-entry