CVE-2018-10895: qutebrowser - Cross-Site Request Forgery Vulnerability
Summary
CVE-2018-10895: qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. Affects qutebrowser across 2 version ranges.
< 1.4.1
< 43e58ac865ff862c2008c510fc5f7627e10b4660
Fixed in 43e58ac865ff862c2008c510fc5f7627e10b4660. How to fix ↓
Also tracked for
- qutebrowser · Debian:11
The same CVE-2018-10895 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qutebrowser is a web browser that focuses on keyboard efficiency and minimalism. It is built using Python and QtWebEngine, providing users with a fast and customizable browsing experience. However, qutebrowser versions prior to 1.4.1 are vulnerable to a cross-site request forgery (CSRF) flaw. This vulnerability allows malicious websites to access 'qute://' URLs and exploit them to execute arbitrary code.
Vulnerability Detail
The CSRF vulnerability in qutebrowser arises from a flaw that enables websites to load 'qute://settings/set' URLs. By doing so, an attacker can modify the 'editor.command' setting to execute a bash script of their choice. This can lead to arbitrary code execution on the victim's system. An attacker could trick a user into visiting a malicious website, which would then exploit this vulnerability to execute arbitrary commands on the user's machine.
How To Fix
Latest published version: 3.7.0 as of 23 Oct 2026
pip install --upgrade "qutebrowser==3.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
43e58ac865ff862c2008c510fc5f7627e10b4660
This is the first release that contains the fix.
pip install --upgrade "qutebrowser==43e58ac865ff862c2008c510fc5f7627e10b4660"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of qutebrowser to ensure the security of your browsing experience.
Conclusion
The CSRF vulnerability in qutebrowser versions prior to 1.4.1 allows malicious websites to execute arbitrary code on a user's system. To mitigate this risk, users should update to qutebrowser version 1.4.1 or later. It is crucial to keep software up to date to ensure a secure browsing experience. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for qutebrowser →
FAQ
qutebrowser is a keyboard-focused web browser built using Python and QtWebEngine. It offers a minimalistic and efficient browsing experience.
Cross-Site Request Forgery (CSRF) is a type of security vulnerability that allows an attacker to perform unwanted actions on behalf of a victim user.
This vulnerability allows malicious websites to execute arbitrary code on a user's system, potentially leading to unauthorized access, data theft, or other malicious activities.
Yes, the vulnerability has been fixed in qutebrowser version 1.4.1. Users are advised to update to this version or later to mitigate the risk.
No, there are no known workarounds for this vulnerability. Updating to the latest version of qutebrowser is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for qutebrowser.
