Due to a CSRF vulnerability affecting the qute://settings page, it was
possible for websites to modify qutebrowser settings. Via settings like
editor.command, this possibly allowed websites to execute arbitrary code.
This issue has been assigned CVE-2018-10895.
The issue was introduced in v1.0.0, as part of commit ffc29ee.
It was fixed in the v1.4.1 release, in commit 43e58ac.
All releases between v1.0.0 and v1.4.0 (inclusive) are affected.
Backported patches are available, but no additional releases are planned:
(add .patch to the URL to get patches)
2018-07-09: I was made aware of the original issue privately (initially
believed by the reporter to only be a DoS issue), developed a fix and contacted
the distros Openwall mailinglist to organize a disclosure date to give
distributions time to coordinate releasing of a fix.
2018-07-10: Slightly updated patch sent to the distros mailinglist.
2018-07-11: Public disclosure.
Please upgrade to v1.4.1 or apply the patches above.
Note that disabling loading of autoconfig.yml is not a suitable remedy, since
settings are still applied until the next restart.
As a workaround, it’s possible to patch out the vulnerable code via a
from qutebrowser.browser import qutescheme qutescheme._qute_settings_set = lambda url: ('text/html', '')
While there is no known exploit for this in the wild, users are advised to
check their autoconfig.yml file (located in the config folder shown in
:version) for any unwanted modifications.