PSF-2026-14: webbrowser.open() allows leading dashes in URLs

Published Mar 20, 2026

Updated

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Affected Software

1 affected component

Python Software Foundation Python webbrowser module

Event History

Mar 20, 2026

CVE Published

via OSV·03:08 PM

Data Sourced

via OSV·03:08 PM

DescriptionSeverity

Frequently Asked Questions

What conditions are needed for exploitation?

An attacker needs to influence a URL passed to webbrowser.open() and have a user trigger the browser-opening action. The URL must begin with a dash so that an affected browser can interpret it as a command-line option.

Who is exposed?

Applications using Python's webbrowser module are exposed when they pass attacker-controlled or insufficiently validated URLs to webbrowser.open(). The impact depends on the web browser invoked and whether it handles leading-dash URLs as command-line options.

What should be done if updating is not immediately possible?

Sanitize and validate URLs before passing them to webbrowser.open(), specifically rejecting values that begin with a dash. Ensure user-controlled input cannot be supplied directly as the URL argument.

PSF-2026-14: webbrowser.open() allows leading dashes in URLs

Affected Software

Event History

Frequently Asked Questions

What conditions are needed for exploitation?

Who is exposed?

What should be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed for exploitation?

Who is exposed?

What should be done if updating is not immediately possible?