CVE-2021-41146 Arbitrary command execution on Windows in qutebrowser
Attackers can execute arbitrary code on Windows by tricking users into opening a crafted URL if qutebrowser is registered as the default handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-41146?
CVE-2021-41146 is a high-severity command injection vulnerability in qutebrowser, published on 21 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.
Which versions are affected by CVE-2021-41146?
3 open source packages ship an affected version, including qutebrowser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
qutebrowser PyPI | All versions | 1.8.0, 2.4.0 |
qutebrowser PyPI | From 1.7.0 | 2.4.0 |
qutebrowser PyPI | From 1.7.0 | 2.4.0 |
Products include Qutebrowser Qutebrowser.
How do I fix CVE-2021-41146?
Upgrade qutebrowser to a fixed version for your release line: 1.8.0 or 2.4.0.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-41146 being exploited?
There is no known exploitation of CVE-2021-41146 in the wild and no public exploit code.
Other vulnerabilities in qutebrowser
Sources
Also known as GHSA-vw27-fwjf-5qxm, PYSEC-2021-382.