CVE-2026-4519 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2026-4519

CVE-2026-4519

Published:March 20, 2026

Updated:April 23, 2026

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Related Resources (16)

https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76

https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e

http://www.openwall.com/lists/oss-security/2026/03/20/1

https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c

https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48

https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5

https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/

https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1

https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4

https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932

https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd