CVE-2026-4519
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.
Published Mar 20, 2026 · updated Aug 13, 2026 · python python
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 20, 2026 · NIST NVD
Detected
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
Aug 13, 2026 · NIST NVD
Updated
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
Affected
- cpe python/pythonversion unspecified
- cpe python/python3.15.0
Sources
- CVE.orgVulnerability recordCVE-2026-4519
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4519
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
nvd.nist.gov