CVE-2026-4519: webbrowser.open() allows leading dashes in URLs
Last updated 6 July 2026
Other sources
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
— Launchpad
webbrowser.open() allows leading dashes in URLs
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.23+dfsg-1 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u2Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u7 - Configuration
Sanitize any URL string before passing it to webbrowser.open(), to prevent handling of leading dashes as command-line options in certain web browsers.
CPython webbrowser.open() URL handling (sanitization) = sanitize prior to calling webbrowser.open()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4519?
CVE-2026-4519 has been categorized as a medium severity vulnerability.
How do I fix CVE-2026-4519?
To fix CVE-2026-4519, ensure that URLs are sanitized by removing any leading dashes before passing them to webbrowser.open().
What issue does CVE-2026-4519 address?
CVE-2026-4519 addresses the issue where leading dashes in URLs are accepted by the webbrowser.open() API, potentially causing unintended command line option handling.
Which software is affected by CVE-2026-4519?
CVE-2026-4519 affects the Python Software Foundation's CPython webbrowser module.
Is there a patch available for CVE-2026-4519?
Yes, the patch for CVE-2026-4519 was introduced to reject URLs with leading dashes in the updated webbrowser.open() API.