Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Qutebrowser Windows Installer Allows Malicious URL Execution

CVE-2021-41146 · published 5 years ago
Summary

A vulnerability in qutebrowser's Windows installer allows malicious URLs to run arbitrary code. This only affects qutebrowser installed on Windows and requires a specific setup where the qutebrowser URL handler is registered. To fix, update to qutebrowser version 2.4.0 or later.

What to do
  • Update freya bruhin qutebrowser to version 2.4.0.
Affected software
Ecosystem VendorProductAffected versions
pip freya bruhin qutebrowser >= 1.7.0, < 2.4.0
Fix: upgrade to 2.4.0
– qutebrowser qutebrowser <= 1.7.0
>= 2.0.0, < 2.4.0
cpe:2.3:a:qutebrowser:qutebrowser:*:*:*:*:*:*:*:*
Original advisory text
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With ce...
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-641Improper Restriction of Names for Files and Other Resources
Timeline
Published21 Oct 2021
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-vw27-fwjf-5qxm · GHSA
CVE-2021-41146 · NVD
Track software like this
Free during beta