CVE-2026-4519 Details
Description
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
A vulnerability exists in the Python CPython standard library's webbrowser module, specifically in the webbrowser.open() API. This API previously accepted URLs with leading dashes, which could be misinterpreted as command line options by certain web browsers. The issue has been addressed by updating the API to reject leading dashes. Users are advised to sanitize URLs before passing them to webbrowser.open() to prevent potential misinterpretation.
Users are recommended to sanitize URLs before using them with the webbrowser.open() API. The latest version of CPython, which includes this fix, can be downloaded from the official Python website.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | CISA-ADP |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| python python | < 3.13.13 >= 3.14.0, < 3.14.4 3.15.0 alpha1 3.15.0 alpha2 3.15.0 alpha3 3.15.0 alpha4 3.15.0 alpha5 3.15.0 alpha6 3.15.0 alpha7 |
CPE
Remediation
| |
Change History
13 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | [email protected] |
| Mar 25, 2026 | CVE Modified | [email protected] |
| Mar 25, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | CVE Modified | [email protected] |
| Mar 20, 2026 | CVE Modified | CVE |
| Mar 20, 2026 | CVE Modified | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |