CVE-2026-4519

3.3 LOW
Published: March 20, 2026 Modified: April 16, 2026
View on NVD

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932
Source: cna@python.org
Patch
https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03
Source: cna@python.org
Patch
https://github.com/python/cpython/issues/143930
Source: cna@python.org
Issue Tracking Patch
https://github.com/python/cpython/pull/143931
Source: cna@python.org
Issue Tracking Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/
Source: cna@python.org
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/20/1
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory

16 reference(s) from NVD

Quick Stats

CVSS v3 Score
3.3 / 10.0
EPSS (Exploit Probability)
0.0%
1th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

python

Related CVEs

CVE-2026-4049 N/A
CVE-2026-41455 8.5
CVE-2026-41454 8.3
CVE-2026-41314 N/A
CVE-2026-41313 N/A