CVE-2017-17513: Tug Tex Live

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linked_scripts/context/stubs/unix/mtxrun, texmf-dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua.

Affected products

• Tug Tex Live: up to and including 20170524

Published 2017-12-14. Last modified 2026-06-17.