CVE-2026-4519
webbrowser.open() allows leading dashes in URLs
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
| Vendor | python software foundation |
| Product | cpython |
| Published | Mar 20, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new high vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.13.13 3.14.0 < 3.14.4 3.15.0a1 < 3.15.0a8
References
github.com: https://github.com/python/cpython/pull/143931 github.com: https://github.com/python/cpython/issues/143930 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ github.com: https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 github.com: https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b github.com: https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 github.com: https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 github.com: https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 github.com: https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 github.com: https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd github.com: https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e github.com: https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 github.com: https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 github.com: https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c github.com: https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 openwall.com: http://www.openwall.com/lists/oss-security/2026/03/20/1 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-4519 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2449649 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4519.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10102 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9614 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9745 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13812 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7244 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6256 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19064 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19019 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6473 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6281 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6283 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9387 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9621 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9386 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9289 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9591 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9261 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9260 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10101 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9042 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10111 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9354 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9705 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7010 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6766 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6286 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6285 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19216 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19175 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19177 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19176 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25096 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7335 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19724 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19725 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16008 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8748 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8746 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16030 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8747 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16009 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16174 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7329 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10140 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10141 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6016 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6035 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7443 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7661 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21275 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10065
Credits
Seth Larson Gregory P. Smith 🔍 an7y