Vulnerability Report

CVE-2026-4519

Title: Command Line Option Injection in webbrowser.open()

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-4519.

CWE Category NVD-CWE-noinfo

Published Date Mar 20, 2026

Modified Date Jul 15, 2026

Exploit Status Not Found

Score 7.0 CVSS v4.0

Exploit Probability (EPSS)

0.31%

Vulnerability Summary

CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Impacted Vendors

python 1

python_software_foundation 1

Reference Links

https://github.com/python/cpython/issues/143930 https://github.com/python/cpython/pull/143931 https://mail.python.org/archives/list/[email protected]/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/

CVSS v4.0

Source Entity [email protected]

Severity HIGH

7.0

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

ACTIVE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity LOW

3.3

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v3.1

Source Entity 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Severity HIGH

7.1

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns