What’s Vulnerable › Vulnerabilities

CVE-2026-4519: webbrowser.open() allows leading dashes in URLs

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-20 · updated 2026-08-13
• Weakness: CWE-20

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Affected products

• Python: before 3.13.13; from 3.14.0 before 3.14.4; 3.15.0-alpha1, 3.15.0-alpha2, 3.15.0-alpha3, 3.15.0-alpha4, 3.15.0-alpha5, 3.15.0-alpha6 (+1) — fixed in 3.13.13, 3.14.4

How to fix

Upgrade to a fixed version: Python 3.13.13, 3.14.4. Check the vendor advisory for mitigations.

References

• https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd
• https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866
• https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e
• https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1
• https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b
• https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4
• https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76
• https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c
• https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5
• https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48
• https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932
• https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03

Get alerted when CVE-2026-4519 or the next vulnerability affects your stack