DEBIAN-CVE-2026-4519

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2026-4519
Published: 20 Mar 2026, 15:16
Last modified:11 Jul 2026, 21:00

Vulnerability Summary

Overall Risk (default)
low
13/100
CVSS Score
3.3 LOW
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Mar 2026, 15:16
Published
Vulnerability first disclosed
11 Jul 2026, 21:00
Last Modified
Vulnerability information updated

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

CVSS Metrics

  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected Systems

  • debian•jython

    all | all | all | all

  • debian•pypy3

    all | all | all | all | < 7.3.22+dfsg-1

  • debian•python2.7

    all

  • debian•python3.11

    all | < 3.11.2-6+deb12u8

  • debian•python3.13

    all | all | < 3.13.5-2+deb13u2 | < 3.13.14-1

  • debian•python3.14

    all | < 3.14.4-1

  • debian•python3.9

    all | < 3.9.2-1+deb11u7

References (1)