Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2021-41146— Arbitrary command execution on Windows in qutebrowser

Quick assessment

Affected
qutebrowser qutebrowser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

qutebrowser是一款基于Python和PyQt5的开源键盘浏览器。 qutebrowser 存在安全漏洞，该漏洞源于 qtebrowser 的 Windows 安装程序注册了一个 qutebrowserurl: URL 处理程序。对于某些应用程序，打开特制的 qutebrowserurl:... URL 会导致执行 qtebrowser 命令，这反过来又允许通过诸如 :spawn 或 :debug-pyeval 之类的命令执行任意代码。

CVSS 8.8 · High EPSS 1.50% · P72
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-41146

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arbitrary command execution on Windows in qutebrowser
Source: CVE Program / CVE List V5
Vulnerability Description
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
qutebrowser 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
qutebrowser是一款基于Python和PyQt5的开源键盘浏览器。 qutebrowser 存在安全漏洞，该漏洞源于 qtebrowser 的 Windows 安装程序注册了一个 qutebrowserurl: URL 处理程序。对于某些应用程序，打开特制的 qutebrowserurl:... URL 会导致执行 qtebrowser 命令，这反过来又允许通过诸如 :spawn 或 :debug-pyeval 之类的命令执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
qutebrowser qutebrowser >= 1.7.0, < 2.4.0 -

II. Public POCs for CVE-2021-41146

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-41146

请登录查看更多情报信息。

Patches & Fixes for CVE-2021-41146 (1)

Vendor Advisories for CVE-2021-41146 (1)

IV. Related Vulnerabilities

Same product: qutebrowser
Same vendor: qutebrowser
Same weakness: CWE-77

V. Comments for CVE-2021-41146

No comments yet

Leave a comment