Command Injection in External URL Opening

CMS fields

• Advisory: Command Injection in External URL Opening
• Advisory ID: BGSA-2026-007 (proposed; confirm availability)
• Reporter reference: BG-05 (URL handler)
• CVE: Not assigned
• Severity: Medium (researcher-assessed; no CVSS score assigned)
• Affected version: 2.0.3 — commit bb3a210 (reproduced by the maintainer)
• Fixed version: 2.0.4 (maintainer-confirmed corrected release)
• Status: Draft — publication pending coordinated disclosure
• Meta title: BastionGuard External URL Command Injection | BGSA-2026-007
• Meta description: Advisory for a reported unsafe external URL opener that passed URL data into a shell command in BastionGuard 2.0.3.
• Index: No while draft; Yes after coordinated publication
• Redirect: None
• Suggested slug: external-url-opening-command-injection

Advisory body (English)

Summary

An external URL opener was reported to construct a shell command by concatenating a URL into an invocation of the platform URL-opening tool.

Security impact

If an attacker-controlled URL reaches the vulnerable opener, command execution with the privileges of the current user may be possible after the relevant navigation action.

Affected and fixed versions

The project maintainer reproduced the reported vulnerability in BastionGuard 2.0.3, commit bb3a210. The correction is included in BastionGuard 2.0.4, as confirmed by the maintainer and supported by the reviewed source and regression tests. Versions other than the confirmed affected revision have not been exhaustively assessed.

Remediation

• Launch the URL handler with explicit argument vectors or an equivalent API that does not invoke a shell.
• Treat external links as untrusted input and validate supported schemes.

Recommended action: Upgrade to the verified official BastionGuard 2.0.4 build or a later maintained release.

Verification scope

The corrected xdg-open.cpp path no longer uses system() for URL launching. The maintainer reproduced the affected historical behavior; the audit environment did not independently replay it against that commit.

Credits

Reported by Shaik Ikram. The project thanks the researcher for the responsible security report and requests that publication be coordinated with the researcher’s agreed disclosure schedule.

References

• BastionGuard source repository
• Security policy

Timeline

• Report received: October 2026
• Disclosure date: To be agreed / added before publication
• Fix release date: Confirm from the published 2.0.4 release record

Editorial verification (not part of public advisory): Maintainer confirms reproduction on bb3a210 and remediation in 2.0.4. Before publication, record the released package/tag and date, reserve the advisory ID, agree disclosure timing and credit with the researcher, and evaluate CVE eligibility through the appropriate CNA. Do not invent a CVE or CVSS score.