Riskcovery

CVE-2026-4519

webbrowser.open() allows leading dashes in URLs

State
Published
Severity
7.0 High
Published
Mar 20, 2026
Updated
Aug 13, 2026
Reserved
Mar 20, 2026

Read the record on cve.org

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Scores

CVSSScoreVectorSource
4.07.0 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NPSF
3.17.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Lredhat-SADP

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

ProductVersions
CPythonPython Software Foundation
  • before 3.10.21Affected
  • 3.11.0 to before 3.11.16Affected
  • 3.12.0 to before 3.12.14Affected
  • 3.13.0 to before 3.13.13Affected
  • 3.14.0 to before 3.14.4Affected
  • 3.15.0a1 to before 3.15.0a8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.