CVE Feed

    Dashboard / CVE / CVE-2026-4519

    CVE-2026-4519

    The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

    Published:Mar 20, 2026
    Last Modified:Apr 16, 2026
    EPS:Mar 20, 2026
    EPSS Score:0.00034
    CVSS Score:3.3

    Affected Products

    Vendor
    Python
    Product
    Cpython
    Vendor
    Python
    Product
    Python

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-10 Buffer Overflow via Environment Variables
    CAPEC-101 Server Side Include (SSI) Injection
    CAPEC-104 Cross Zone Scripting
    CAPEC-108 Command Line Execution through SQL Injection
    CAPEC-109 Object Relational Mapping Injection
    CAPEC-110 SQL Injection through SOAP Parameter Tampering
    CAPEC-120 Double Encoding
    CAPEC-13 Subverting Environment Variable Values
    CAPEC-135 Format String Injection
    CAPEC-136 LDAP Injection
    CAPEC-137 Parameter Injection
    CAPEC-14 Client-side Injection-induced Buffer Overflow
    CAPEC-153 Input Data Manipulation
    CAPEC-174 Flash Parameter Injection
    CAPEC-182 Flash Injection
    CAPEC-209 XSS Using MIME Type Mismatch
    CAPEC-22 Exploiting Trust in Client
    CAPEC-23 File Content Injection
    CAPEC-230 Serialized Data with Nested Payloads
    CAPEC-231 Oversized Serialized Data Payloads
    CAPEC-24 Filter Failure through Buffer Overflow
    CAPEC-250 XML Injection
    CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data
    CAPEC-267 Leverage Alternate Encoding
    CAPEC-28 Fuzzing
    CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
    CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies
    CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads
    CAPEC-42 MIME Conversion
    CAPEC-43 Exploiting Multiple Input Interpretation Layers
    CAPEC-45 Buffer Overflow via Symbolic Links
    CAPEC-46 Overflow Variables and Tags
    CAPEC-460 HTTP Parameter Pollution (HPP)
    CAPEC-47 Buffer Overflow via Parameter Expansion
    CAPEC-473 Signature Spoof
    CAPEC-52 Embedding NULL Bytes
    CAPEC-53 Postfix, Null Terminate, and Backslash
    CAPEC-588 DOM-Based XSS
    CAPEC-63 Cross-Site Scripting (XSS)
    CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
    CAPEC-664 Server Side Request Forgery
    CAPEC-67 String Format Overflow in syslog()
    CAPEC-7 Blind SQL Injection
    CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
    CAPEC-72 URL Encoding
    CAPEC-73 User-Controlled Filename
    CAPEC-78 Using Escaped Slashes in Alternate Encoding
    CAPEC-79 Using Slashes in Alternate Encoding
    CAPEC-8 Buffer Overflow in an API Call
    CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic
    CAPEC-81 Web Server Logs Tampering
    CAPEC-83 XPath Injection
    CAPEC-85 AJAX Footprinting
    CAPEC-88 OS Command Injection
    CAPEC-9 Buffer Overflow in Local Command-Line Utilities

    Related CVEs

    CVE-2026-15310 (CVSS 2.1) — When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacke…
    CVE-2026-19672 (CVSS 6.3) — The tarfile module's tar and data extraction filters created directories outside the destination for members…
    CVE-2026-15806 (CVSS 6) — The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRe…
    CVE-2026-17084 (CVSS 6) — The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unico…
    CVE-2026-18503 (CVSS 2.4) — Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and …
    CVE-2026-6879 (CVSS 2) — `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath …
    CVE-2026-15308 (CVSS 8.7) — The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated untermi…
    CVE-2026-4360 (CVSS 2) — In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An a…
    CVE-2026-11972 (CVSS 8.2) — When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not …
    CVE-2026-0864 (CVSS 4.1) — When using the "configparser" module to write configuration files containing multi-line text values with carri…

    References

    https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd
    https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866
    https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e
    https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1
    https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b
    https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4
    https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76
    https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c
    https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5
    https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48
    https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932
    https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03
    https://github.com/python/cpython/issues/143930
    https://github.com/python/cpython/pull/143931
    https://mail.python.org/archives/list/[email protected]/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/
    http://www.openwall.com/lists/oss-security/2026/03/20/1
    https://access.redhat.com/errata/RHSA-2026:10065
    https://access.redhat.com/errata/RHSA-2026:10101
    https://access.redhat.com/errata/RHSA-2026:10102
    https://access.redhat.com/errata/RHSA-2026:10111
    https://access.redhat.com/errata/RHSA-2026:10140
    https://access.redhat.com/errata/RHSA-2026:10141
    https://access.redhat.com/errata/RHSA-2026:13812
    https://access.redhat.com/errata/RHSA-2026:16008
    https://access.redhat.com/errata/RHSA-2026:16009
    https://access.redhat.com/errata/RHSA-2026:16030
    https://access.redhat.com/errata/RHSA-2026:16174
    https://access.redhat.com/errata/RHSA-2026:19019
    https://access.redhat.com/errata/RHSA-2026:19064
    https://access.redhat.com/errata/RHSA-2026:19175
    https://access.redhat.com/errata/RHSA-2026:19176
    https://access.redhat.com/errata/RHSA-2026:19177
    https://access.redhat.com/errata/RHSA-2026:19216
    https://access.redhat.com/errata/RHSA-2026:19724
    https://access.redhat.com/errata/RHSA-2026:19725
    https://access.redhat.com/errata/RHSA-2026:21275
    https://access.redhat.com/errata/RHSA-2026:25096
    https://access.redhat.com/errata/RHSA-2026:6016
    https://access.redhat.com/errata/RHSA-2026:6035
    https://access.redhat.com/errata/RHSA-2026:6256
    https://access.redhat.com/errata/RHSA-2026:6281
    https://access.redhat.com/errata/RHSA-2026:6283
    https://access.redhat.com/errata/RHSA-2026:6285
    https://access.redhat.com/errata/RHSA-2026:6286
    https://access.redhat.com/errata/RHSA-2026:6473
    https://access.redhat.com/errata/RHSA-2026:6766
    https://access.redhat.com/errata/RHSA-2026:7010
    https://access.redhat.com/errata/RHSA-2026:7244
    https://access.redhat.com/errata/RHSA-2026:7329
    https://access.redhat.com/errata/RHSA-2026:7335
    https://access.redhat.com/errata/RHSA-2026:7443
    https://access.redhat.com/errata/RHSA-2026:7661
    https://access.redhat.com/errata/RHSA-2026:8746
    https://access.redhat.com/errata/RHSA-2026:8747
    https://access.redhat.com/errata/RHSA-2026:8748
    https://access.redhat.com/errata/RHSA-2026:9042
    https://access.redhat.com/errata/RHSA-2026:9260
    https://access.redhat.com/errata/RHSA-2026:9261
    https://access.redhat.com/errata/RHSA-2026:9262
    https://access.redhat.com/errata/RHSA-2026:9289
    https://access.redhat.com/errata/RHSA-2026:9354
    https://access.redhat.com/errata/RHSA-2026:9386
    https://access.redhat.com/errata/RHSA-2026:9387
    https://access.redhat.com/errata/RHSA-2026:9591
    https://access.redhat.com/errata/RHSA-2026:9614
    https://access.redhat.com/errata/RHSA-2026:9621
    https://access.redhat.com/errata/RHSA-2026:9705
    https://access.redhat.com/errata/RHSA-2026:9745
    https://access.redhat.com/security/cve/CVE-2026-4519
    https://bugzilla.redhat.com/show_bug.cgi?id=2449649
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4519.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High