qBittorrent WebUI RSS links: HTTP(S) only, with a version caveat

qBittorrent’s built-in WebUI in 5.3.0 permits only HTTP or HTTPS URLs when you use an RSS article’s Open news URL or Open link action. It blocks other schemes, including javascript: and magnet:, from those browser-opening actions. This is a navigation safeguard—not a verdict that a website or torrent is trustworthy. The implementation is visible in the 5.3.0 RSS view.

There is an important version caveat: the official 5.2.4 changelog lists this fix, but the tagged 5.2.4 RSS view does not contain the same protection. Do not rely on that version number alone.

Why an RSS link needs a security check

An RSS article’s link comes from the feed, not from qBittorrent itself. Treat it as untrusted input even when it appears inside your client’s interface.

For an absolute URL, the scheme—the portion before the first colon—determines how it is handled. A javascript: URL is not an ordinary website address: browsers can execute its code when navigating to it. MDN documents this behavior and warns against using such URLs.

qBittorrent’s security-labeled pull request #24790, merged on August 17, 2026, adds a scheme check before opening RSS article links and search-result description pages. The check parses the URL with the browser’s URL API and accepts only the resulting http: or https: protocol. It is not simply a case-sensitive text-prefix check.

What is allowed—and where

The filter applies to these built-in WebUI actions:

• RSS → Open news URL: checks each selected article link before opening it.
• RSS article details → Open link: supplies a clickable destination only if the link passes the check.
• Search-result description page: checks the description URL before opening a new tab.

The merged patch and its tests establish the intended behavior:

URL type	Result of the scheme check
https://example.org/releases	Allowed
http://example.org/releases	Allowed
Relative path such as /releases	Allowed when resolved against an HTTP(S) WebUI address
javascript:, data:, file: or ftp:	Blocked
mailto: or magnet:	Blocked

“HTTP(S) only” therefore does not mean “HTTPS required.” Nor is it a domain allowlist: the 5.3.0 helper checks the protocol, not the publisher’s identity, page contents or download safety. This patch covers the navigation actions above, not every URL embedded in an RSS description or the safety of RSS-triggered downloads.

The 5.2.4 changelog caveat

qBittorrent released 5.2.4 on September 28, 2026. Both the official news entry and the GitHub release notes list “Only open http(s) URLs from RSS articles and search results.”

However, the tagged 5.2.4 RSS view still passes article links directly to window.open() and assigns the details link’s href without that check. Its URL helper file also lacks isHttpUrl. The corresponding 5.3.0 source contains the check. This source comparison does not establish whether a particular distributor has backported the patch into its 5.2.4 package.

For this safeguard, use the built-in 5.3.0 WebUI or a maintained build whose provider confirms the patch is included. If qBittorrent runs on a NAS, server or container, update that running installation—not just a client on your laptop. Reload the browser interface afterward. An alternative WebUI needs its own confirmation; the built-in code does not establish what a third-party interface does.

What to do when a link is blocked

The RSS context-menu action can display:

Blocked opening RSS article URL. Only http:// and https:// links can be opened.

In the article-details panel, a rejected link instead has no navigation destination and carries the blocking message as its tooltip. These behaviors are defined in the 5.3.0 RSS implementation.

Do not bypass the warning by pasting an unfamiliar scheme into your browser. For an expected release page, visit the publisher’s known website independently or ask the feed provider to correct the article link.

A blocked magnet article link does not mean magnet downloads are disabled. RSS article navigation uses the article’s link; the separate Download torrent action uses torrentURL. These can be different destinations. Use Download torrent only if that download destination is one you trust. For a verified magnet supplied by a lawful publisher, you can instead use the WebUI’s magnet-adding workflow, rather than trying to open it as a news page. Download and share only material you have the right to use.