CVE-2026-4519

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Risk Information

Base Score

7.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

EPSS Score

Exploitation Probability

0.033

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2026-4519 are affected in Python 3.13.12	Windows
Vulnerabilities CVE-2026-4519 are affected in Python 3.14.3	Windows
Multiple Vulnerabilities are affected in Python 3.15.0-alpha1	Windows
Vulnerabilities CVE-2025-12084,CVE-2025-13837,CVE-2026-4519 are affected in Python 3.15.0-alpha2	Windows
Vulnerabilities CVE-2026-4519 are affected in Python 3.15.0-alpha3	Windows
Vulnerabilities CVE-2026-4519 are affected in Python 3.15.0-alpha4	Windows
Vulnerabilities CVE-2026-4519 are affected in Python 3.15.0-alpha5	Windows
Vulnerabilities CVE-2026-4519 are affected in Python 3.15.0-alpha6	Windows
Vulnerabilities CVE-2026-4519 are affected in Python 3.15.0-alpha7	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234