CVE-2026-4519

Aliases:RHSA-2026:6016RHSA-2026:6035UBUNTU-CVE-2026-4519DEBIAN-CVE-2026-4519ALPINE-CVE-2026-4519CGA-3h84-x2w3-jxqgCGA-4q45-537w-2w8wCGA-4wwp-7g84-8876CGA-98cv-hx2c-frrfCGA-9mfp-c2vp-mr25CGA-f4c2-gfhc-p78wCGA-gjpr-v3j3-429fCGA-2h9w-hx8g-9jfpCGA-pchq-87rf-53wvCGA-r4rr-7h23-pmrfCGA-v6g6-mgvv-39h9CGA-xr2r-237r-fjfj
Advisory lineage Upstream: 0 Downstream: 58
Modified
Published: 20 Mar 2026, 15:08
Last modified:13 Aug 2026, 00:27

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7.1 HIGH
v3.1 (cve.org)
EPSS Score
0.31% LOW
0% probability +0.09%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Mar 2026, 15:08
Published
Vulnerability first disclosed
13 Aug 2026, 00:27
Last Modified
Vulnerability information updated

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

CVSS Metrics

  • v4.0•HIGH•Score: 7CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  • v4.0•HIGH•Score: 7CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS Trends

Current EPSS score: 0.31%• Percentile: 24%

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  • CWE-88•Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

    The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected Systems

  • alpine•python3

    < 3.12.14-r0 | < 3.12.14-r0 | < 3.12.14-r0

  • chainguard•python-3.10

    < 3.10.20-r1

  • chainguard•python-3.11

    < 3.11.15-r1

  • chainguard•python-3.12

    < 3.12.13-r1

  • chainguard•python-3.13

    < 3.13.12-r5

  • chainguard•python-3.14

    < 3.14.3-r5

  • chainguard•python-3.9

    all

  • wolfi•python-3.10

    < 3.10.20-r1

  • wolfi•python-3.11

    < 3.11.15-r1

  • wolfi•python-3.12

    < 3.12.13-r1

  • wolfi•python-3.13

    < 3.13.12-r5

  • wolfi•python-3.14

    < 3.14.3-r5

  • debian•jython

    all | all | all | all

  • debian•pypy3

    all | all | all | < 7.3.22+dfsg-1

  • debian•python2.7

    all

  • debian•python3.11

    < 3.11.2-6+deb12u8

  • debian•python3.13

    < 3.13.5-2+deb13u2 | < 3.13.14-1

  • debian•python3.14

    < 3.14.4-1

  • debian•python3.9

    < 3.9.2-1+deb11u7

  • ubuntu•jython

    all | all | all | all | all | all | all

  • ubuntu•pypy3

    all | all | all | all | all

  • ubuntu•python2.7

    all

  • ubuntu•python3.10

    < 3.10.12-1~22.04.16

  • ubuntu•python3.11

    all | all

  • ubuntu•python3.12

    < 3.12.3-1ubuntu0.15

  • ubuntu•python3.13

    all

  • ubuntu•python3.14

    all

  • ubuntu•python3.4

    all

  • ubuntu•python3.5

    all

  • ubuntu•python3.6

    all

  • ubuntu•python3.7

    all

  • ubuntu•python3.8

    all

  • ubuntu•python3.9

    all

  • python software foundation•cpython

    < 3.15.0 | < 3.14.4 | < 3.13.13 | < 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.13 | ≥ 3.14.0, < 3.14.4 | ≥ 3.15.0a1, < 3.15.0a8

  • python•python

    < 3.13.13 | ≥ 3.14.0, < 3.14.4 | 3.15.0:alpha1 | 3.15.0:alpha2 | 3.15.0:alpha3 | 3.15.0:alpha4 | 3.15.0:alpha5 | 3.15.0:alpha6 | 3.15.0:alpha7

  • redhat•python3.11

    < 0:3.11.15-2.hum1

  • redhat•python3.12

    < 0:3.12.13-2.hum1

References (83)