CVE-2026-4519
Python vulnerabilities
Description
A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.
Metrics
Affected operating systems
linux
debian / debian_linux10.0
linux
debian / debian_linux11.0
linux
redhat / enterprise_linux8.0
linux
ubuntu / python2.7bionic
linux
ubuntu / python2.7focal
linux
ubuntu / python2.7jammy
linux
ubuntu / python2.7trusty
linux
ubuntu / python2.7xenial
linux
ubuntu / python3.10jammy
linux
ubuntu / python3.11jammy
linux
ubuntu / python3.12noble
linux
ubuntu / python3.14resolute
linux
ubuntu / python3.4trusty
linux
ubuntu / python3.5trusty
linux
ubuntu / python3.5xenial
linux
ubuntu / python3.6bionic
linux
ubuntu / python3.7bionic
linux
ubuntu / python3.8bionic
linux
ubuntu / python3.8focal
linux
ubuntu / python3.9focal
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
bitnami
python-min3.10.0
bitnami
python-min3.11.0
bitnami
python-min3.12.0
bitnami
python-min3.13.0
bitnami
python-min3.14.0
bitnami
python-min3.6.0
bitnami
python-min3.7.0
bitnami
python-min3.8.0
bitnami
python-min3.9.0
python
python3.14.0 – 3.14.4
python
python3.13.13
python
python
python-markdown
markdown
References & sources
- https://github.com/python/cpython/issues/145506report
- https://github.com/python/cpython/pull/145507web
- https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603efix
- https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535efix
- https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86fix
- https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9fix
- https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89ddfix
- https://github.com/python/cpython/commit/c70adad78caeeea33f92f560ecb93331ca11bf66patch
- http://www.openwall.com/lists/oss-security/2026/03/05/6
- https://github.com/python/cpython/pull/146212web
- https://github.com/python/cpython/issues/146211report
- https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/advisory
- https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69fix
- https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2edfix
- https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8ddfix
- https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ecfix
- https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53fix
- https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3efix
- http://www.openwall.com/lists/oss-security/2026/04/11/4
- https://nvd.nist.gov/vuln/detail/CVE-2026-1502web
Linked CVEs
- CVE-2026-9669
bz2.BZ2Decompressor objects could be reused after a decompression error.
high - CVE-2026-8328
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.
medium - CVE-2026-7774
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect late…
medium - CVE-2026-6100
A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`.
criticalCVSSv3 8.1 - CVE-2026-6019
A flaw was found in Python's `http.cookies` module.
mediumCVSSv3 6.1 - CVE-2026-5713
A flaw was found in Python.
medium - CVE-2026-4786
A flaw was found in the Python webbrowser.open() API.
highCVSSv3 7.1 - CVE-2026-4224
A stack overflow flaw has been discovered in the python pyexpat module.
highCVSSv3 7.5 - CVE-2026-3644
A control character validation flaw has been discovered in the Python http.cookie module.
highCVSSv3 7.5 - CVE-2026-3276
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining cha…
medium - CVE-2026-2297
A flaw was found in CPython.
medium - CVE-2026-1502
A flaw was found in Python.
medium - CVE-2026-1299
A flaw was found in the email module in the Python standard library.
medium - CVE-2026-0672
An injection flaw has been discovered in Python.
medium - CVE-2025-69534
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unha…
highCVSSv3 7.5 - CVE-2025-13462
A flaw was found in the `tarfile` module of cpython.
lowCVSSv3 3.3 - CVE-2021-4189
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode.
mediumCVSSv3 5.3