Arbitrary Code Execution Affecting qutebrowser package, versions [1.7.0,2.4.0)


Severity

0.0
high
0
10

    Threat Intelligence

    EPSS
    0.31% (70th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-QUTEBROWSER-1766504
  • published 22 Oct 2021
  • disclosed 22 Oct 2021
  • credit Unknown

How to fix?

Upgrade qutebrowser to version 2.4.0 or higher.

Overview

qutebrowser is a keyboard-driven, vim-like browser based on PyQt5.

Affected versions of this package are vulnerable to Arbitrary Code Execution. The Windows installer for qutebrowser registers a qutebrowserurl: URL handler. With certain applications, opening a specially crafted qutebrowserurl:... URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as :spawn or :debug-pyeval.

Only Windows installs where qutebrowser is registered as URL handler are affected.

References

CVSS Scores

version 3.1
Expand this section

Snyk

8.8 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    Required
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

NVD

8.8 high