When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being p

The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local v

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachm

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by

Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent

Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but u

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL