PT-2026-76533

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split ascii whitespace. If an application passes an attacker-controlled non-HTTPS URL whose parsed form retains...