The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows…

published 2010-08-19 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-2813

cvss: 6.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.3%; EPSS 7.3% chance of exploitation in 30 days, percentile 94%
public exploits: 1; Exploit-DB

The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.

Patch / fix

links 3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2010-2809 updated 2025-11-21

uzbl: malicious code execution via unsanitized @SELECTED_URI

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2010-08-05 First public exploit (EDB-34426)
2010-08-19 Published

Exploit prediction

7.34% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-34426 uzbl 'uzbl-core' - '@SELECTED_URI' Mouse Button Bindings Command Injection remote, 2010-08-05

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

Sources

CVE List CVE-2010-2809
NVD CVE-2010-2809

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary