PT-2026-26624 · Python+3 · Cpython+3
CVSS v3.1
7.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
CPython (affected versions not specified)
Description
The
webbrowser.open() API accepted leading dashes in URLs, which could be interpreted as command line options by certain web browsers. This behavior has been modified to reject leading dashes. The issue involves the potential for command execution through crafted URLs passed to the webbrowser.open() function. The vulnerable component is the webbrowser.open() API endpoint. The vulnerable parameter is the URL passed to the webbrowser.open() function.Recommendations
Sanitize URLs prior to passing them to the
webbrowser.open() function.Exploit
Correção
DoS
Argument Injection
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cpython
Linuxmint
Red Os
Rocky Linux