PYSEC-2018-27

2018-07-1212:29:00

Google

osv.dev

0.002 Low

EPSS

Percentile

57.3%

JSON

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access ‘qute://*’ URLs. A malicious website could exploit this to load a ‘qute://settings/set’ URL, which then sets ‘editor.command’ to a bash script, resulting in arbitrary code execution.

CPENameOperatorVersion
qutebrowsereq0.0.0
qutebrowsereq0.11.0
qutebrowsereq0.4.0
qutebrowsereq1.0.0
qutebrowsereq1.3.3
qutebrowsereq0.3.0
qutebrowsereq0.1.0
qutebrowsereq1.0.1
qutebrowsereq0.1.1
qutebrowsereq1.0.2

Name	Operator	Version
qutebrowser	eq	0.0.0
qutebrowser	eq	0.11.0
qutebrowser	eq	0.4.0
qutebrowser	eq	1.0.0
qutebrowser	eq	1.3.3
qutebrowser	eq	0.3.0
qutebrowser	eq	0.1.0
qutebrowser	eq	1.0.1
qutebrowser	eq	0.1.1
qutebrowser	eq	1.0.2