CVE-2018-1000559

qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).

• CWE-79

• https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7Patch, Third Party Advisory
• https://github.com/qutebrowser/qutebrowser/commit/5a7869f2feaa346853d2a85413d6527c87ef0d9fPatch, Third Party Advisory
• https://github.com/qutebrowser/qutebrowser/issues/4011Exploit, Third Party Advisory
• https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7Patch, Third Party Advisory
• https://github.com/qutebrowser/qutebrowser/commit/5a7869f2feaa346853d2a85413d6527c87ef0d9fPatch, Third Party Advisory
• https://github.com/qutebrowser/qutebrowser/issues/4011Exploit, Third Party Advisory

Published

Jun 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000553Trovebox version <= 4.0.0-rc6 contains a Server-Side request…
• CVE-2018-1000554Trovebox version <= 4.0.0-rc6 contains a Unsafe password res…
• CVE-2018-1000555Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000556WordPress version 4.8 + contains a Cross Site Scripting (XSS…
• CVE-2018-1000557OCS Inventory OCS Inventory NG version ocsreports 2.4 contai…
• CVE-2018-1000558OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version…
• CVE-2018-1000600A exposure of sensitive information vulnerability exists in …
• CVE-2018-1000601A arbitrary file read vulnerability exists in Jenkins SSH Cr…
• CVE-2018-1000602A session fixation vulnerability exists in Jenkins SAML Plug…
• CVE-2018-1000603A exposure of sensitive information vulnerability exists in …
• CVE-2018-1000604A persisted cross-site scripting vulnerability exists in Jen…
• CVE-2018-1000605A man in the middle vulnerability exists in Jenkins CollabNe…