Vulnerability · Published Oct 21, 2021 · Assigned by GitHub_M
CVE-2021-41146Arbitrary command execution on Windows in qutebrowser
High 8.8
In plain English
A high-severity command injection in qutebrowser from qutebrowser. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | qutebrowser | 2.4.0 | GHSA-vw27-fwjf-5qxm |
| PyPI | qutebrowser | 1.8.0, 2.4.0 | PYSEC-2021-382 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| qutebrowser | qutebrowser | >= 1.7.0, < 2.4.0 |
Weakness: CWE-77, CWE-88, CWE-641 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H