PT-2026-26624 · Python · Cpython

Seth Larson · Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-4519

Mitre

CVSS v4.0

7.0

High

AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Fix

Related Identifiers

CVE-2026-4519

Affected Products

Cpython

References · 6

• https://mail.python.org/archives/list/[e-mail]/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4519 · Security Note
• https://github.com/python/cpython/pull/143931 · Patch
• http://openwall.com/lists/oss-security/2026/03/20/1 · Note
• https://github.com/python/cpython/issues/143930 · Note
• https://twitter.com/cyberbivash/status/2035035716091101291 · Twitter Post