Logo
›
›vulnerability›CVE-2026-4519
Name
CVE-2026-4519
Source
NVD ( link)Debian ( link)
Description
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
CWEs
CWE-20 CWE-88
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270ddPatch
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866Patch
https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73ePatch
https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1Patch
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02bPatch
https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4Patch
https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76Patch
https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96cPatch
https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5Patch
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48Patch
https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932Patch
https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03Patch
https://github.com/python/cpython/issues/143930Issue Tracking
https://github.com/python/cpython/pull/143931Issue Tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/20/1Mailing List

Analysis#

Affected Component
Analysis
python3
Patched

Vulnerability Ratings#

7
CVSSv4
3.3
CVSSv31
7.1
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
python3
buildroot
2025.02.x
3.12.14
Exploitable
python3
buildroot
master
3.14.7
Not Affected
python3
openwrt
master
3.14.5-r2
Not Affected
python3
openwrt
openwrt-25.12
3.13.9-r3
Exploitable
python3
yocto
kirkstone
3.10.20
Exploitable
python3
yocto
master
3.14.7
Not Affected

Resolved with patches#

python3 (yocto:scarthgap)

#
Title
Author
Resolve
1
[3.11] gh-143930: Tweak the exception message and
"Miss Islington (bot)"
CVE-2026-4519
2
[3.11] gh-148169: Fix webbrowser `%action` substitution
Stan Ulbrych <stan@python.org>
CVE-2026-4519
CVE-2026-4786
3
[3.12] gh-143930: Reject leading dashes in webbrowser
Pinky <pinky00ch@gmail.com>
CVE-2026-4519