CVE-2018-1000559: qutebrowser Cross Site Scripting (XSS) Vulnerability
Summary
CVE-2018-1000559: qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript... Affects qutebrowser across 3 version ranges.
>= 0.11.0, < 1.3.3
< 4c9360237f186681b1e3f2a0f30c45161cf405c7
< 5a7869f2feaa346853d2a85413d6527c87ef0d9f
Fixed in 5a7869f2feaa346853d2a85413d6527c87ef0d9f. How to fix ↓
Also tracked for
- qutebrowser · Debian:11
The same CVE-2018-1000559 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qutebrowser is a Python-based web browser with a minimalistic design and a focus on keyboard-driven navigation. It allows users to browse the web efficiently and securely. However, qutebrowser versions prior to v1.3.3 and v1.4.0 are vulnerable to a Cross Site Scripting (XSS) attack.
Vulnerability Detail
The XSS vulnerability in qutebrowser allows an attacker to inject malicious JavaScript code into the qute://history page. By exploiting this vulnerability, an attacker can steal the user's browsing history. To exploit this vulnerability, the victim must open a page with a specially crafted <title> attribute and then open the qute://history site using the :history command.
How To Fix
Latest published version: 3.7.0 as of 23 Oct 2026
pip install --upgrade "qutebrowser==3.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5a7869f2feaa346853d2a85413d6527c87ef0d9f
This is the first release that contains the fix.
pip install --upgrade "qutebrowser==5a7869f2feaa346853d2a85413d6527c87ef0d9f"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions of qutebrowser to mitigate the risk of exploitation.
Conclusion
The qutebrowser Cross Site Scripting (XSS) vulnerability allows an attacker to inject malicious JavaScript code and steal the user's browsing history. It is crucial to update to the fixed versions of qutebrowser (v1.3.3 or v1.4.0) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qutebrowser →
FAQ
qutebrowser is a Python-based web browser with a minimalistic design and a focus on keyboard-driven navigation.
This vulnerability allows an attacker to steal the user's browsing history by injecting malicious JavaScript code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your version of qutebrowser is affected by this vulnerability.
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of qutebrowser.
You can find more information about this vulnerability in the qutebrowser advisory on the PyPI advisory database (https://github.com/pypa/advisory-database/blob/main/vulns/qutebrowser/PYSEC-2018-26.yaml).
References
Related vulnerabilities
Recent vulnerabilities recorded for qutebrowser.
