TI-2021-17985 Aliases CVE-2021-41146 GHSA-vw27-fwjf-5qxm

Arbitrary command execution on Windows in qutebrowser

MEDIUM 41CWE-641Published 2021-10-21 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.

Why it matters now

EPSS 0.01496 74th percentileScored 2026-11-07

Fix Fixed qutebrowser (qutebrowser): 2.4.0qutebrowser (PyPI): 2.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
qutebrowser	qutebrowser	1.7.0 to before 2.4.0	2.4.0	Patch available	CNA
—	qutebrowser (PyPI)	1.7.0 to before 2.4.0	2.4.0	Patch available	GHSA-vw27-fwjf-5qxm

qutebrowser Vendorqutebrowser Affected 1.7.0 to before 2.4.0 Fixed in 2.4.0 Patch available CNA
qutebrowser (PyPI) Vendor— Affected 1.7.0 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-vw27-fwjf-5qxm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:qutebrowser:qutebrowser::::::::	up to 1.7.0; 2.0.0 to before 2.4.0	Vulnerable	qutebrowser

cpe:2.3:a:qutebrowser:qutebrowser:*:*:*:*:*:*:*:* Versions up to 1.7.0; 2.0.0 to before 2.4.0 Vulnerable ·qutebrowser

Remediation

Fix · CNA qutebrowser (qutebrowser) Fixed in 2.4.0
Fix · GHSA-vw27-fwjf-5qxm qutebrowser (PyPI) Fixed in 2.4.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2021-41146
2026-10-03 Alias added: GHSA-vw27-fwjf-5qxm

References

Patch 1

https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430

Advisory 2

Other 2

TI-2018-07708 Cross-site request forgery in qutebrowser cross-site request forgery flaw allows sites to… CVSS 3.0CRITICAL 9.3
TI-2018-15954 qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449)… CVSS 3.0MEDIUM 6.1
TI-2020-08928 Incorrect Provision of Specified Functionality in qutebrowser CVSS 3.1LOW 3.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences