Skip to content

Vendor

qutebrowser vulnerabilities

4 published CVES affecting qutebrowser, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
2
Medium
1
Low
1
Unscored
0
CISA KEV
0
Atom feed of qutebrowser alerts

Products

Latest qutebrowser CVEs

Newest publication first

  1. CVE-2021-41146 Arbitrary command execution on Windows in qutebrowser

    Published
    HighCVSS 8.8 EPSS 1.5%

    qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a qutebrowserurl: URL handler. With certain applications, opening a specially crafted qutebrowserurl:... URL can lead to ex...

  2. CVE-2020-11054 Incorrect Provision of Specified Functionality in qutebrowser

    Published
    LowCVSS 3.5 EPSS 1.5%

    In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently l...

  3. CVE-2018-10895 Qutebrowser CSRF Vulnerability

    Published
    HighCVSS 8.8 EPSS 1.2%

    qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrar...

  4. CVE-2018-1000559 Qutebrowser XSS Vulnerability

    Published
    MediumCVSS 6.1 EPSS 1.5%

    qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.