CVEvulnerability

CVE-2026-4519

7.0 HIGH Published 2026-03-20 Modified 2026-08-13 Official page ↗
Status
Modified
Published
2026-03-20
Last modified
2026-08-13
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.0 HIGH — CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Weaknesses
CWE-20, CWE-88

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Affected configurations

• python python (< 3.13.13) • python python (>= 3.14.0 < 3.14.4) • python python 3.15.0

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References