CVE-2018-1000559: qutebrowser Cross Site Scripting (XSS) Vulnerability
Summary
CVE-2018-1000559: Qutebrowser XSS Vulnerability. Affects qutebrowser versions >= 0.11.0, < 1.3.3. Fixed in 1.3.3. How to fix ↓
Also tracked for
- qutebrowser · Debian:11
The same CVE-2018-1000559 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
qutebrowser is an open-source web browser that focuses on keyboard efficiency and minimalism. It is built using Python and QtWebEngine, providing users with a fast and customizable browsing experience. However, qutebrowser versions prior to v1.4.0 are vulnerable to a Cross Site Scripting (XSS) attack.
Vulnerability Detail
The XSS vulnerability in qutebrowser version 0.11.0 allows an attacker to inject malicious JavaScript code into the qute://history page. By exploiting this vulnerability, an attacker can steal a user's browsing history. The attack requires the victim to open a page with a specially crafted <title> attribute and then access the qute://history site using the :history command.
How To Fix
Latest published version: 3.7.0 as of 23 Oct 2026
pip install --upgrade "qutebrowser==3.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.3
This is the first release that contains the fix.
pip install --upgrade "qutebrowser==1.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of qutebrowser as soon as possible.
Conclusion
The qutebrowser XSS vulnerability in versions prior to v1.4.0 poses a moderate security risk, allowing attackers to steal a user's browsing history. Users should update their qutebrowser installation to either v1.3.3 or v1.4.0 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qutebrowser →
FAQ
qutebrowser is an open-source web browser that prioritizes keyboard efficiency and minimalism.
Cross Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users.
The vulnerability allows an attacker to inject JavaScript code into the qute://history page, enabling them to steal a user's browsing history.
qutebrowser versions prior to v1.4.0 are affected by this XSS vulnerability.
Updating qutebrowser to either v1.3.3 or v1.4.0 will protect you from this vulnerability. It is recommended to always keep your software up to date.
References
Related vulnerabilities
Recent vulnerabilities recorded for qutebrowser.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
