CVE-2026-4519
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
- Affected products
- Cpython, Linuxmint, Red Os, Rocky Linux, Ubuntu
- Python
- < 3.13.13, 3.14.4, 3.15.0
- Fix
- Available
- CVSS 3.1
- 7.1 HIGH
- EPSS
- 0.3% (23th percentile)
- Weakness
- CWE-88, CWE-20
- NVD status
- Modified
- Published
- 2026-03-20
CVE-2026-4519 at NVD
No indexed exploits for CVE-2026-4519 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-4519 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.