CVE-2018-10895: PYSEC-2018-27 - qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malici

CVE-2018-10895 · Severity: low · CVSS 3 · Published 2018-07-12

Technologies: qutebrowser (PyPI). Vendors: PyPI.

Executive brief

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution.

Affected products

PyPI qutebrowser

Related threats

PYSEC-2021-382 - qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for quteb
PYSEC-2020-97 - In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridd
PYSEC-2018-26 - qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in