Qutebrowser CSRF Vulnerability

2018-10-1016:05:23

Google

osv.dev

0.002 Low

EPSS

Percentile

57.3%

JSON

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access qute://* URLs. A malicious website could exploit this to load a qute://settings/set URL, which then sets editor.command to a bash script, resulting in arbitrary code execution.

CPENameOperatorVersion
qutebrowsereq0.0.0
qutebrowsereq0.11.0
qutebrowsereq0.4.0
qutebrowsereq1.0.0
qutebrowsereq1.3.3
qutebrowsereq0.3.0
qutebrowsereq0.1.0
qutebrowsereq1.0.1
qutebrowsereq0.1.1
qutebrowsereq1.0.2

Name	Operator	Version
qutebrowser	eq	0.0.0
qutebrowser	eq	0.11.0
qutebrowser	eq	0.4.0
qutebrowser	eq	1.0.0
qutebrowser	eq	1.3.3
qutebrowser	eq	0.3.0
qutebrowser	eq	0.1.0
qutebrowser	eq	1.0.1
qutebrowser	eq	0.1.1
qutebrowser	eq	1.0.2