Low severity · published Mar 20, 2026
CVE-2026-4519
webbrowser.open() allows leading dashes in URLs
3.3
CVSS
0.3%
EPSS
No
On KEV
Description
The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open().
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.13; 3.14.0 before 3.14.4; 3.15.0a1 before 3.15.0a8 · source: vendor
PY
Python · Python
before 3.13.13; 3.14.0 before 3.14.4; 3.15.0; 3.15.0; 3.15.0; 3.15.0; +3 more · source: NVD
RB
RHEL-8 based Middleware Containers · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat AI Inference Server 3.2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat AI Inference Server 3.3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Discovery 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8.2 Advanced Update Support · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4519
Patch
https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd
Patch
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866
Patch
https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e
Patch
https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1
Patch
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b
Patch
https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF