3 ms·

It does not require opening a browser, it can cause a browser to open.

• Groxx 6y ago
  Which is not on its own a "vulnerability", you'd need to chain it to something usable in the browser / as a consequence of the browser being opened. It increases your options, certainly, but it can't do anything dangerous as-is.
  • ragerino 6y ago
    You can define any executable in the $BROWSER environment variable which will be executed whenever antigravity is imported. You could execute a 'curl` which directly pipes into 'bash -c'.
    • Too 6y ago
      "Any executable" does not mean adding pipes and arguments. This is one important benefit of not using shell. See https://github.com/python/cpython/blob/master/Lib/webbrowser.py#L174 https://github.com/python/cpython/blob/master/Lib/webbrowser...
  • thefreeman 6y ago
    This is flat wrong. You can cause it to run an arbitrary binary by setting the BROWSER environment variable, as they demonstrate in the article. They chained it with perl environment variable vulnerability listed earlier to achieve execution.
    • Groxx 6y ago
      Yep, I misunderstood then - definitely vulnerable on its own!