CVE-2008-4690: Lynx

High severity, CVSS 10.0. EPSS: 5.1% chance of exploitation in the next 30 days.

lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.

Affected products

• Lynx Lynx: up to and including 2.8.6; version 2.8.1 only; version 2.8.2 only; version 2.8.3 only; version 2.8.4 only; version 2.8.5 only; …

Published 2008-10-22. Last modified 2026-06-16.