qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NQutebrowser
APPQutebrowser< 1.4.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
References
Related vulnerabilities
CVE-2021-41146HIGH8.8ten sam produkt
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, t...
CVE-2018-1000559MEDIUM6.1ten sam produkt
qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scr...
CVE-2020-11054LOW3.5ten sam produkt
In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a ...