CVE-2026-4519
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The webbrowser.open() API in Python would accept URLs starting with dashes, which could be interpreted as command line options by certain web browsers. The new behavior rejects such URLs.
Risk Assessment
The risk involves potential execution of unauthorized commands or alteration of browser behavior by passing a crafted URL, which could lead to system security compromise.
Recommendation
It is recommended to immediately update Python to a version that includes the fix rejecting leading dashes in URLs. Additionally, sanitize URLs before passing them to webbrowser.open().
Original NVD description (English source)
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().