CVE-2026-4519

EUVD-2026-13712
The webbrowser.open() API would accept leading dashes in the URL which 
could be handled as command line options for certain web browsers. New 
behavior rejects leading dashes. Users are recommended to sanitize URLs 
prior to passing to webbrowser.open().
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7 HIGH
LOCAL
LOW
NONE
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
pythoncpython
𝑥
< 3.15.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
jython
bookworm
vulnerable
bullseye
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
pypy3
bookworm
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
python2.7
bullseye
vulnerable
python3.11
bookworm
vulnerable
bookworm (security)
vulnerable
python3.13
forky
vulnerable
sid
vulnerable
trixie
vulnerable
python3.14
forky
vulnerable
sid
vulnerable
python3.9
bullseye
vulnerable
bullseye (security)
vulnerable
Common Weakness Enumeration
References
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b
https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76
https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48
https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03
https://github.com/python/cpython/issues/143930
https://github.com/python/cpython/pull/143931
https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/
http://www.openwall.com/lists/oss-security/2026/03/20/1