CLEANSTART-2024-QJ78550 When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped

🗓️ 30 Oct 2026 19:18:44Reported by GoogleType

osv_cleanstart🔗 osv.dev👁 3 Views

Improperly escaped URL parameters in multiple library packages lead to issues.

Reporter	Title	Published	Views	Family All 205
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 91.4.0-alt1	14 Dec 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 91.4.0-alt1	21 Dec 202100:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 91.8.0ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	29 Apr 202204:43	–	ibm
attackerkb	CVE-2021-43541	8 Dec 202122:15	–	attackerkb
Tenable Nessus	AlmaLinux 8 : firefox (ALSA-2021:5013)	9 Feb 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : thunderbird (ALSA-2021:5045)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : firefox (CESA-2021:5013)	10 Dec 202100:00	–	nessus
Tenable Nessus	CentOS 8 : thunderbird (CESA-2021:5045)	10 Dec 202100:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2021:5014)	9 Oct 202400:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2024/CLEANSTART-2024-QJ78550.json
osv	www.osv.dev/vulnerability/CVE-2021-43541
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-43541

31 Oct 2026 01:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.5

EPSS0.01694

library improperly escaped URL protocol handlers