CPython webbrowser.open() Leading-Dash URL Injection in 3.15
CVE-2026-4519 Published on March 20, 2026

webbrowser.open() allows leading dashes in URLs
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-4519 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
LOW

Weakness Types

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What is an Argument Injection Vulnerability?

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

CVE-2026-4519 has been classified to as an Argument Injection vulnerability or weakness.


Products Associated with CVE-2026-4519

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-4519 are published in these products:

Cpython
 
Red Hat Rhel Els
 
Red Hat Rhosemc
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel E4s
 
Red Hat Rhel Tus
 
Red Hat Rhel Eus
 
Red Hat Ai Inference Server
 
Red Hat Discovery
 
Red Hat Enterprise Linux Ai
 
Red Hat Hummingbird
 
Red Hat Rhui
 
Canonical Ubuntu Linux
 

Affected Versions

Python Software Foundation CPython: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION: Red Hat Enterprise Linux 7 Extended Lifecycle Support: Red Hat Enterprise Linux 7 Extended Lifecycle Support: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.2 Advanced Update Support: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.6 Telecommunications Update Service: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat Discovery 2: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8:

Exploit Probability

EPSS
0.22%
Percentile
11.93%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.