PT-2026-26624 · Python+2 · Cpython+2
An7Y
+1
·
Publicado
2026-01-01
·
Atualizado
2026-05-19
·
CVE-2026-4519
CVSS v4.0
7.0
Alta
| Vetor | AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
CPython (affected versions not specified)
Description
The
webbrowser.open() API accepted leading dashes in URLs, which could be interpreted as command line options by certain web browsers. This behavior has been modified to reject leading dashes. The issue involves the potential for command execution through crafted URLs passed to the webbrowser.open() function. The vulnerable component is the webbrowser.open() API endpoint. The vulnerable parameter is the URL passed to the webbrowser.open() function.Recommendations
Sanitize URLs prior to passing them to the
webbrowser.open() function.Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cpython
Red Os
Rocky Linux