GitHub Advisoryadvisory · PyPI

GHSA-wgmx-52ph-qqcw Qutebrowser CSRF Vulnerability

HIGH Published 2018-10-10 Modified 2024-10-16 Official page ↗
Aliases
CVE-2018-10895
Ecosystem
PyPI
Packages
qutebrowser
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• PyPI qutebrowser: < 1.4.1 → fixed in 1.4.1

Description

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access `qute://*` URLs. A malicious website could exploit this to load a `qute://settings/set` URL, which then sets `editor.command` to a bash script, resulting in arbitrary code execution.

Related

Alias · CVE (1)

  • CVE-2018-10895 qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References