CVE-2026-4519

High

Open

TLP:CLEAR

webbrowser.open() allows leading dashes in URLs

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Details

CVSS Score: 7.0
EPSS Score ⓘ: 0.31%

23.3th percentile
CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Mar 20, 2026
Last Modified: Aug 13, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.