| Package | Affected versions | Patched versions |
|---|---|---|
| qutebrowser | < 1.4.1 | 1.4.1 |
| qutebrowser | < 1.4.1 | 1.4.1 |
qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access qute://* URLs. A malicious website could exploit this to load a qute://settings/set URL, which then sets editor.command to a bash script, resulting in arbitrary code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free