← Vulnerability feed

Vulnerability record · CVE-2026-4519 · published 20 March 2026

CVE-2026-4519: Python improper input validation vulnerability

Python · Python

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

7.0 CVSS 4.0 High EPSS 0.39% · top 69.4% CWE-20 · Improper input validationCWE-88 · Argument injection
7.0CVSS 4.0 base score
0.39%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
71References
13 Aug 2026Last modified by NVD

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd Patch
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 Patch
https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e Patch
https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 Patch
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b Patch
https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 Patch
https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 Patch
https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c Patch
https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 Patch
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 Patch
https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 Patch
https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 Patch
https://github.com/python/cpython/issues/143930 Issue TrackingPatch
https://github.com/python/cpython/pull/143931 Issue TrackingPatch
https://mail.python.org/archives/list/[email protected]/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/20/1 Mailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2026:10065
https://access.redhat.com/errata/RHSA-2026:10101
https://access.redhat.com/errata/RHSA-2026:10102
https://access.redhat.com/errata/RHSA-2026:10111
https://access.redhat.com/errata/RHSA-2026:10140
https://access.redhat.com/errata/RHSA-2026:10141
https://access.redhat.com/errata/RHSA-2026:13812
https://access.redhat.com/errata/RHSA-2026:16008
https://access.redhat.com/errata/RHSA-2026:16009
https://access.redhat.com/errata/RHSA-2026:16030
https://access.redhat.com/errata/RHSA-2026:16174
https://access.redhat.com/errata/RHSA-2026:19019
https://access.redhat.com/errata/RHSA-2026:19064
https://access.redhat.com/errata/RHSA-2026:19175
https://access.redhat.com/errata/RHSA-2026:19176
https://access.redhat.com/errata/RHSA-2026:19177
https://access.redhat.com/errata/RHSA-2026:19216
https://access.redhat.com/errata/RHSA-2026:19724
https://access.redhat.com/errata/RHSA-2026:19725
https://access.redhat.com/errata/RHSA-2026:21275
https://access.redhat.com/errata/RHSA-2026:25096
https://access.redhat.com/errata/RHSA-2026:6016
https://access.redhat.com/errata/RHSA-2026:6035
https://access.redhat.com/errata/RHSA-2026:6256

Track CVE-2026-4519 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-5031Python vulnerabilityMultiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer va…EPSS 3.0%9.8CVE-2022-48565Python xml external entity (xxe) vulnerabilityAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist fil…EPSS 5.1%9.8CVE-2022-37454Extended keccak code package project extended keccak code package integer overflow vulnerabilityThe Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute …EPSS 5.8%9.8CVE-2021-29921Python vulnerabilityIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) all…EPSS 6.9%9.8CVE-2021-3177Python classic buffer overflow vulnerabilityPython 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic…EPSS 23%9.8CVE-2020-27619Python vulnerabilityIn Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.EPSS 8.3%9.8CVE-2020-15801Python untrusted search path vulnerabilityIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <execu…EPSS 3.5%9.8CVE-2014-4650Python path traversal vulnerabilityThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remo…EPSS 25%

Source: NIST National Vulnerability Database (record CVE-2026-4519), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.