Vulnerability · Published Mar 20, 2026 · Assigned by PSF
CVE-2026-4519webbrowser.open() allows leading dashes in URLs
High 7.1
In plain English
A high-severity improper input validation in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 74.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 3.6.8-75.el8_10.alma.1 | ALSA-2026:6473 |
| AlmaLinux:8 | platform-python-debug | 3.6.8-75.el8_10.alma.1 | ALSA-2026:6473 |
| AlmaLinux:8 | platform-python-devel | 3.6.8-75.el8_10.alma.1 | ALSA-2026:6473 |
| AlmaLinux:10 | python-unversioned-command | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:10 | python-unversioned-command | 3.12.12-3.el10_1.2 | ALSA-2026:6256 |
| AlmaLinux:9 | python-unversioned-command | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:9 | python-unversioned-command | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:10 | python3 | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:9 | python3 | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:9 | python3 | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-debug | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:9 | python3-debug | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:9 | python3-debug | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:10 | python3-devel | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:9 | python3-devel | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:9 | python3-devel | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-idle | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-idle | 3.6.8-75.el8_10.alma.1 | ALSA-2026:6473 |
| AlmaLinux:9 | python3-idle | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:9 | python3-idle | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-libs | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-libs | 3.6.8-75.el8_10.alma.1 | ALSA-2026:6473 |
| AlmaLinux:9 | python3-libs | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:9 | python3-libs | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:10 | python3-test | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-test | 3.6.8-75.el8_10.alma.1 | ALSA-2026:6473 |
| AlmaLinux:9 | python3-test | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:9 | python3-test | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-tkinter | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-tkinter | 3.6.8-75.el8_10.alma.1 | ALSA-2026:6473 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-3.el9_7.2 | ALSA-2026:6766 |
| AlmaLinux:8 | python3.11 | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:9 | python3.11 | 3.11.13-5.2.el9_7 | ALSA-2026:6286 |
| AlmaLinux:9 | python3.11 | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-debug | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:9 | python3.11-debug | 3.11.13-5.2.el9_7 | ALSA-2026:6286 |
| AlmaLinux:9 | python3.11-debug | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-devel | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:9 | python3.11-devel | 3.11.13-5.2.el9_7 | ALSA-2026:6286 |
| AlmaLinux:9 | python3.11-devel | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-idle | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:9 | python3.11-idle | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:9 | python3.11-idle | 3.11.13-5.2.el9_7 | ALSA-2026:6286 |
| AlmaLinux:8 | python3.11-libs | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:9 | python3.11-libs | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:9 | python3.11-libs | 3.11.13-5.2.el9_7 | ALSA-2026:6286 |
| AlmaLinux:8 | python3.11-rpm-macros | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:8 | python3.11-test | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:9 | python3.11-test | 3.11.13-5.2.el9_7 | ALSA-2026:6286 |
| AlmaLinux:9 | python3.11-test | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-tkinter | 3.11.13-6.el8_10 | ALSA-2026:6281 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.13-5.2.el9_7 | ALSA-2026:6286 |
| AlmaLinux:8 | python3.12 | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:9 | python3.12 | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:9 | python3.12 | 3.12.12-4.el9_7.2 | ALSA-2026:6285 |
| AlmaLinux:8 | python3.12-debug | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:9 | python3.12-debug | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:9 | python3.12-debug | 3.12.12-4.el9_7.2 | ALSA-2026:6285 |
| AlmaLinux:8 | python3.12-devel | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:9 | python3.12-devel | 3.12.12-4.el9_7.2 | ALSA-2026:6285 |
| AlmaLinux:9 | python3.12-devel | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-idle | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:9 | python3.12-idle | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:9 | python3.12-idle | 3.12.12-4.el9_7.2 | ALSA-2026:6285 |
| AlmaLinux:8 | python3.12-libs | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:9 | python3.12-libs | 3.12.12-4.el9_7.2 | ALSA-2026:6285 |
| AlmaLinux:9 | python3.12-libs | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:8 | python3.12-test | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:9 | python3.12-test | 3.12.12-4.el9_7.2 | ALSA-2026:6285 |
| AlmaLinux:9 | python3.12-test | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.12-4.el8_10 | ALSA-2026:6283 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.12-4.el9_7.2 | ALSA-2026:6285 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:10 | python3.14 | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14 | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-debug | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-debug | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-devel | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-devel | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-debug | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-debug | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-devel | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-devel | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-idle | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-idle | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-libs | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-libs | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-test | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-test | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-tkinter | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-tkinter | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-idle | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-idle | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-libs | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-libs | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-test | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-test | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-tkinter | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-tkinter | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| Alpine:v3.21 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-4519 |
| Alpine:v3.22 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-4519 |
| Alpine:v3.23 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-4519 |
| Debian:12 | jython | no fix listed | DEBIAN-CVE-2026-4519 |
| Debian:13 | jython | no fix listed | DEBIAN-CVE-2026-4519 |
| Debian:14 | jython | no fix listed | DEBIAN-CVE-2026-4519 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-4519 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-4519 |
| Debian:14 | pypy3 | 7.3.22+dfsg-1 | DEBIAN-CVE-2026-4519 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u8 | DEBIAN-CVE-2026-4519 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u2 | DEBIAN-CVE-2026-4519 |
| Debian:14 | python3.14 | 3.14.4-1 | DEBIAN-CVE-2026-4519 |
| Rocky Linux:8 | python3 | 0:3.6.8-75.el8_10.rocky.0 | RLSA-2026:6473 |
| Rocky Linux:8 | python3.11 | 0:3.11.13-6.el8_10 | RLSA-2026:6281 |
| Rocky Linux:9 | python3.11 | 0:3.11.13-5.2.el9_7 | RLSA-2026:6286 |
| Rocky Linux:9 | python3.11 | 0:3.11.13-9.el9_8 | RLSA-2026:19175 |
| Rocky Linux:10 | python3.12 | 0:3.12.13-2.el10_2 | RLSA-2026:19064 |
| Rocky Linux:8 | python3.12 | 0:3.12.12-4.el8_10 | RLSA-2026:6283 |
| Rocky Linux:9 | python3.12 | 0:3.12.12-4.el9_7.2 | RLSA-2026:6285 |
| Rocky Linux:9 | python3.12 | 0:3.12.13-2.el9_8 | RLSA-2026:19177 |
| Rocky Linux:10 | python3.14 | 0:3.14.4-2.el10_2 | RLSA-2026:19019 |
| Rocky Linux:9 | python3.14 | 0:3.14.4-2.el9_8 | RLSA-2026:19176 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-3.el9_7.2 | RLSA-2026:6766 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-7.el9_8 | RLSA-2026:19216 |
| Ubuntu:22.04:LTS | jython | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:24.04:LTS | jython | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:25.10 | jython | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:26.04:LTS | jython | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:26.10 | jython | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:25.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | USN-8509-1 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | UBUNTU-CVE-2026-4519 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | UBUNTU-CVE-2026-4519 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | USN-8509-1 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-4519 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | USN-8509-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.133.14.0 – before 3.14.43.15.0a1 – before 3.15.0a8 |
Weakness: CWE-20, CWE-88 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
References
- https://github.com/python/cpython/pull/143931 patch
- https://github.com/python/cpython/issues/143930 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ vendor-advisory
- https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 patch
- https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b patch
- https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 patch
- https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 patch
- https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 patch
- https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 patch
- https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd patch
- https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e patch
- https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 patch
- https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 patch
- https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c patch
- https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 patch
- http://www.openwall.com/lists/oss-security/2026/03/20/1
- https://access.redhat.com/security/cve/CVE-2026-4519 vdb-entry, x_refsource_REDHAT
- RHBZ#2449649 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4519.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:10102 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9614 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9745 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13812 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7244 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6256 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19064 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19019 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6473 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6281 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6283 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9387 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9621 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9386 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9289 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9591 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9261 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9262 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9260 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10101 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9042 vendor-advisory, x_refsource_REDHAT