Description
Lynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynxprog links, which are not properly restricted in the default configuration in some environments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | lynx | 2.8.5-18.2 | RHSA-2005:839 |
| RHEL 3 | lynx | 2.8.5-11.2 | RHSA-2005:839 |
Advisories 1
- RHSA-2005:839 Red Hat Security Advisory: lynx security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 17556 third-party-advisory
- 18376 third-party-advisory
- 17666 third-party-advisory
- 15395 vdb-entry
- ADV-2005-2394 vdb-entry
- 17546 third-party-advisory
- 17576 third-party-advisory
- OpenPKG-SA-2005.026 vendor-advisory
- 17757 third-party-advisory
- oval:org.mitre.oval:def:9712 vdb-entry signature
- 20051110 Multiple Vendor Lynx Command Injection Vulnerability third-party-advisory
- lynx-lynxcgi-command-execute(23119) vdb-entry
- FLSA:152832 vendor-advisory
- GLSA-200511-09 vendor-advisory
- 18659 third-party-advisory
- RHSA-2005:839 vendor-advisory
- 173 third-party-advisory
- 18051 third-party-advisory
- 17512 third-party-advisory
- MDKSA-2005:211 vendor-advisory
- 17372 third-party-advisory
- 1015195 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-035.htm