GHSA-rm92-fj5q-mpj5

GHSA-rm92-fj5q-mpj5 PUBLISHED CVSS 3.299999952316284 LOW

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Risk Scores

CVSS 3.1

3.299999952316284

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Timeline

Mar 20, 2026 CVE Published
Apr 26, 2026 Security Advisory
Jun 30, 2026 CVE Updated
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch
Aug 6, 2026 Distribution Patch

References

http://www.openwall.com/lists/oss-security/2026/03/20/1 url
https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS url
https://github.com/python/cpython/issues/143930 discussion
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 fix
https://nvd.nist.gov/vuln/detail/CVE-2026-4519 advisory
https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e fix
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b fix
https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 fix
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 fix
https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 fix
https://github.com/python/cpython/pull/143931 fix
https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd fix
https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c fix
https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 fix
https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 fix
https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 fix
https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 url
https://access.redhat.com/errata/RHSA-2026:9262 url
https://access.redhat.com/errata/RHSA-2026:9261 url
https://access.redhat.com/errata/RHSA-2026:9260 url

…and 52 more

Open in Interactive Console →