Read the docs
TI-2020-08928 Aliases CVE-2020-11054GHSA-4rcq-jv2f-898j

Incorrect Provision of Specified Functionality in qutebrowser

Priority LOW 20CWE-684Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned.

Why it matters now

EPSS 0.0151 74th percentileScored 2026-11-07
Fix Fixed qutebrowser (qutebrowser): 1.11.1qutebrowser (PyPI): 1.11.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
qutebrowserqutebrowserbefore 1.11.11.11.1Patch availableCNA
—qutebrowser (PyPI)before 1.11.11.11.1Patch availableGHSA-4rcq-jv2f-898j
  • qutebrowser Vendorqutebrowser Affected before 1.11.1 Fixed in 1.11.1 Patch available CNA
  • qutebrowser (PyPI) Vendor— Affected before 1.11.1 Fixed in 1.11.1 Patch available GHSA-4rcq-jv2f-898j

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:qutebrowser:qutebrowser:*:*:*:*:*:*:*:*before 1.11.1Vulnerablequtebrowser
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
  • cpe:2.3:a:qutebrowser:qutebrowser:*:*:*:*:*:*:*:* Versions before 1.11.1 Vulnerable ·qutebrowser
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA qutebrowser (qutebrowser) Fixed in 1.11.1
  • Fix · GHSA-4rcq-jv2f-898j qutebrowser (PyPI) Fixed in 1.11.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11054
  2. 2026-10-03 Alias added: GHSA-4rcq-jv2f-898j

References

Patch 11

Advisory 6

Other 4

  • TI-2018-07708 Cross-site request forgery in qutebrowser cross-site request forgery flaw allows sites to… CVSS 3.0CRITICAL 9.3
  • TI-2021-17985 Arbitrary command execution on Windows in qutebrowser CVSS 3.1HIGH 8.8
  • TI-2018-15954 qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449)… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences