Gentoo Linux Security Advisory 201701-9 - A command injection vulnerability in Xdg-Utils may allow for the execution of arbitrary code. Versions less than 1.1.1 are affected.
6c7ba3fc33ea6f5b83381c17e253f59095ec8e24ac6ecbe81cc857df883917db
Debian Linux Security Advisory 3131-1 - John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.
0bc385c6b6e3000bee1436fe2d211ac62230a51377f11c33c6cbd35e2274fcb3