CVE-2021-41146: qutebrowser URL Handler Command Execution
Summary
CVE-2021-41146: qutebrowser is an open source keyboard-focused browser with a minimal GUI. Affects qutebrowser across 3 version ranges.
< 1.8.0
>= 2.0.0, < 2.4.0
< 8f46ba3f6dc7b18375f7aa63c48a1fe461190430
Fixed in 1.8.0 or 2.4.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qutebrowser is an open source keyboard-focused browser with a minimal GUI. It provides a unique browsing experience by emphasizing keyboard shortcuts and minimalism. qutebrowser v1.7.0 and later versions introduced a Windows installer that registers a qutebrowserurl: URL handler. This feature allows users to open specific URLs in qutebrowser directly. However, starting from qutebrowser v1.7.0 to v2.4.0, a vulnerability exists in the Windows installer where opening a specially crafted qutebrowserurl: URL can lead to the execution of qutebrowser commands. This can potentially allow an attacker to execute arbitrary code by leveraging commands such as :spawn or :debug-pyeval. It is important to note that only Windows installations where qutebrowser is registered as the URL handler are affected. The qutebrowser development team has addressed this vulnerability in qutebrowser v2.4.0, which also includes additional hardening measures for potential similar issues on Linux.
Vulnerability Detail
The vulnerability in qutebrowser allows for the execution of arbitrary code through specially crafted qutebrowserurl: URLs. When certain applications attempt to open these URLs, qutebrowser commands can be executed, leading to potential code execution. This vulnerability can be exploited by an attacker to execute arbitrary commands on a victim's system, potentially compromising its security. It is important to note that this vulnerability only affects Windows installations where qutebrowser is registered as the URL handler. The qutebrowser development team has fixed this vulnerability in qutebrowser v2.4.0, providing a secure version for users. Additionally, the fix includes measures to enhance security on Linux systems.
How To Fix
Latest published version: 3.7.0 as of 23 Oct 2026
pip install --upgrade "qutebrowser==3.7.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.01.8.0pip install --upgrade "qutebrowser==1.8.0" -
>= 2.0.0, < 2.4.02.4.0pip install --upgrade "qutebrowser==2.4.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability in qutebrowser's Windows installer, which registers a qutebrowserurl: URL handler, allows for the execution of arbitrary code through specially crafted URLs. This vulnerability can be exploited on Windows systems where qutebrowser is registered as the URL handler. To mitigate this risk, users should update their qutebrowser installation to version 2.4.0 or later. The qutebrowser development team has fixed this vulnerability and introduced additional security measures for Linux systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qutebrowser →
FAQ
The vulnerability affects qutebrowser versions starting from v1.7.0 up to v2.4.0. Users with these versions installed on Windows systems where qutebrowser is registered as the URL handler should take immediate action to update to the fixed version.
While the vulnerability primarily affects Windows installations, the qutebrowser development team has implemented additional hardening measures in version 2.4.0 to address potential similar issues on Linux. However, no known vulnerabilities of this nature exist on Linux systems at this time.
The vulnerability allows for the execution of arbitrary code, which can have severe consequences. An attacker could leverage this vulnerability to execute malicious commands on a victim's system, potentially compromising its security, stealing sensitive information, or performing unauthorized actions.
At this time, there is no known workaround for this vulnerability. Users are strongly advised to update their qutebrowser installation to version 2.4.0 or later to mitigate the risk of arbitrary code execution.
Detailed information about the vulnerability, its impact, and the fix can be found in the official qutebrowser documentation, release notes, and the qutebrowser GitHub repository. Users can refer to these resources for a comprehensive understanding of the issue and the steps taken to address it.
References
Related vulnerabilities
Recent vulnerabilities recorded for qutebrowser.
