CVE-2026-4519

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4519
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd Patch
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 Patch
https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e Patch
https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 Patch
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b Patch
https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 Patch
https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 Patch
https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c Patch
https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 Patch
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 Patch
https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 Patch
https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 Patch
https://github.com/python/cpython/issues/143930 Issue Tracking Patch
https://github.com/python/cpython/pull/143931 Issue Tracking Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/20/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*
History

16 Apr 2026, 14:53

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3
CPE cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha7:*:*:*:*:*:*
References () https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd - () https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd - Patch
References () https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 - () https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 - Patch
References () https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e - () https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e - Patch
References () https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 - () https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 - Patch
References () https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b - () https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b - Patch
References () https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 - () https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 - Patch
References () https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 - () https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 - Patch
References () https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c - () https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c - Patch
References () https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 - () https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 - Patch
References () https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 - () https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 - Patch
References () https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 - () https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 - Patch
References () https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 - () https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 - Patch
References () https://github.com/python/cpython/issues/143930 - () https://github.com/python/cpython/issues/143930 - Issue Tracking, Patch
References () https://github.com/python/cpython/pull/143931 - () https://github.com/python/cpython/pull/143931 - Issue Tracking, Patch
References () https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ - () https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/03/20/1 - () http://www.openwall.com/lists/oss-security/2026/03/20/1 - Mailing List, Third Party Advisory
First Time Python
Python python

07 Apr 2026, 18:16

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd -
  • () https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e -
  • () https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 -
  • () https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 -
  • () https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c -
  • () https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 -
Summary
  • (es) La API webbrowser.open() aceptaba guiones iniciales en la URL que podrían ser interpretados como opciones de línea de comandos para ciertos navegadores web. El nuevo comportamiento rechaza los guiones iniciales. Se recomienda a los usuarios sanear las URL antes de pasarlas a webbrowser.open().

25 Mar 2026, 18:16

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 -

25 Mar 2026, 15:16

Type Values Removed Values Added
CWE CWE-20

24 Mar 2026, 20:16

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 -
  • () https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b -
  • () https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 -
  • () https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 -
  • () https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 -

20 Mar 2026, 21:17

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/03/20/1 -

20 Mar 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-20 15:16

Updated : 2026-04-16 14:53

NVD link : CVE-2026-4519

Mitre link : CVE-2026-4519

CVE.ORG link : CVE-2026-4519

JSON object : View

Products Affected

python

  • python
CWE
CWE-20

Improper Input Validation