CVE-2021-41146

qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a `qutebrowserurl:` URL handler. With certain applications, opening a specially crafted `qutebrowserurl:...` URL can lead to execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`. Only Windows installs where qutebrowser is registered as URL handler are affected. The issue has been fixed in qutebrowser v2.4.0. The fix also adds additional hardening for potential similar issues on Linux (by adding the new --untrusted-args flag to the .desktop file), though no such vulnerabilities are known.

• CWE-77
• CWE-88
• CWE-641
• CWE-77

• https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430Patch, Third Party Advisory
• https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxmThird Party Advisory
• https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430Patch, Third Party Advisory
• https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxmThird Party Advisory

Published

Oct 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41140Discourse-reactions is a plugin for the Discourse platform t…5.3
• CVE-2021-41141PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2021-41142Tuleap Open ALM is a libre and open source tool for end to e…5.4
• CVE-2021-41143OpenMage LTS is an e-commerce platform. Prior to versions 19…7.2
• CVE-2021-41144OpenMage LTS is an e-commerce platform. Prior to versions 19…8.8
• CVE-2021-41145FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2021-41147Tuleap Open ALM is a libre and open source tool for end to e…7.2
• CVE-2021-41148Tuleap Open ALM is a libre and open source tool for end to e…8.8
• CVE-2021-41149Tough provides a set of Rust libraries and tools for using a…8.1
• CVE-2021-4115There is a flaw in polkit which can allow an unprivileged us…5.5
• CVE-2021-41150Tough provides a set of Rust libraries and tools for using a…6.5
• CVE-2021-41151Backstage is an open platform for building developer portals…4.9