CVE-1999-1549: Lynx 2.x does not properly distinguish between internal and external HTML, which may allow a local attacker...

Security readout for executives and security teams

This is an old Lynx browser issue where local users could abuse Lynx’s handling of special internal HTML to expose supposedly hidden form data and alter a user’s configuration in a way that could execute commands. The source bundle does not provide CVSS, fixed versions, or modern affected package data. Exposure is most plausible on legacy systems still running Lynx 2.x, especially shared Unix-like environments with local untrusted users. The bundle lists no CPEs, distributions, fixed versions, or evidence of current product exposure. Treat this as a legacy exposure cleanup item, not an internet-scale emergency. Prioritize if Lynx 2.x exists on shared systems, administrative jump hosts, or environments with untrusted local accounts. Mitigation focus: Inventory systems for Lynx 2.x or historically packaged Lynx builds.; Check Lynx vendor or operating-system distributor guidance for fixed versions.; Upgrade or remove legacy Lynx where it is not operationally required..

Prepared

Jul 1, 2026, 08:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.