CVE-2026-4519

Name of the Vulnerable Software and Affected Versions CPython (affected versions not specified)

Description The webbrowser.open() API accepted leading dashes in URLs, which could be interpreted as command line options by certain web browsers. This behavior has been modified to reject leading dashes. The issue involves the potential for command execution through crafted URLs passed to the webbrowser.open() function. The vulnerable component is the webbrowser.open() API endpoint. The vulnerable parameter is the URL passed to the webbrowser.open() function.

Recommendations Sanitize URLs prior to passing them to the webbrowser.open() function.