CVE-2026-4519 [High] | Input Validation Bypass in Python

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-21	—	0.01%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-03-21

—

0.01%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.0	4.0	HIGH	`CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X` Click to expand Attack vector (AV:L) Attacker needs local access on the target system. Attack complexity (AC:L) Exploitation conditions are straightforward and stable. Attack requirements (AT:P) Additional preconditions must be present for exploitation. Privileges required (PR:N) No privileges are required. User interaction (UI:A) User interaction is required in an active way. Vulnerable system confidentiality impact (VC:H) High confidentiality impact on the vulnerable system. Vulnerable system integrity impact (VI:H) High integrity impact on the vulnerable system. Vulnerable system availability impact (VA:N) No availability impact on the vulnerable system. Subsequent system confidentiality impact (SC:N) No confidentiality impact on subsequent systems. Subsequent system integrity impact (SI:N) No integrity impact on subsequent systems. Subsequent system availability impact (SA:N) No availability impact on subsequent systems. Exploit maturity (threat) (E:X) Not defined: no reliable threat intelligence; scoring assumes the worst case (equivalent to Attacked). Confidentiality requirement (CR:X) Not defined: insufficient information; scoring treats this like High (worst case). Integrity requirement (IR:X) Not defined: insufficient information; scoring treats this like High (worst case). Availability requirement (AR:X) Not defined: insufficient information; scoring treats this like High (worst case). Modified attack vector (MAV:X) Not defined: scoring uses the Base Attack Vector (AV). Modified attack complexity (MAC:X) Not defined: scoring uses the Base Attack Complexity (AC). Modified attack requirements (MAT:X) Not defined: scoring uses the Base Attack Requirements (AT). Modified privileges required (MPR:X) Not defined: scoring uses the Base Privileges Required (PR). Modified user interaction (MUI:X) Not defined: scoring uses the Base User Interaction (UI). Modified vulnerable system confidentiality impact (MVC:X) Not defined: scoring uses the Base VC metric. Modified vulnerable system integrity impact (MVI:X) Not defined: scoring uses the Base VI metric. Modified vulnerable system availability impact (MVA:X) Not defined: scoring uses the Base VA metric. Modified subsequent system confidentiality impact (MSC:X) Not defined: scoring uses the Base SC metric. Modified subsequent system integrity impact (MSI:X) Not defined: scoring uses the Base SI metric. Modified subsequent system availability impact (MSA:X) Not defined: scoring uses the Base SA metric. Safety (supplemental) (S:X) Not evaluated. Automatable (supplemental) (AU:X) Not evaluated. Recovery (supplemental) (R:X) Not evaluated. Value density (supplemental) (V:X) Not evaluated. Vulnerability response effort (supplemental) (RE:X) Not evaluated. Provider urgency (supplemental) (U:X) Not evaluated.	—	—	[email protected]
3.3	3.1	LOW	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	1.8	1.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.0

4.0

HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Click to expand

Attack vector (AV:L): Attacker needs local access on the target system.
Attack complexity (AC:L): Exploitation conditions are straightforward and stable.
Attack requirements (AT:P): Additional preconditions must be present for exploitation.
Privileges required (PR:N): No privileges are required.
User interaction (UI:A): User interaction is required in an active way.
Vulnerable system confidentiality impact (VC:H): High confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:H): High integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:N): No availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:N): No confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:N): No integrity impact on subsequent systems.
Subsequent system availability impact (SA:N): No availability impact on subsequent systems.
Exploit maturity (threat) (E:X): Not defined: no reliable threat intelligence; scoring assumes the worst case (equivalent to Attacked).
Confidentiality requirement (CR:X): Not defined: insufficient information; scoring treats this like High (worst case).
Integrity requirement (IR:X): Not defined: insufficient information; scoring treats this like High (worst case).
Availability requirement (AR:X): Not defined: insufficient information; scoring treats this like High (worst case).
Modified attack vector (MAV:X): Not defined: scoring uses the Base Attack Vector (AV).
Modified attack complexity (MAC:X): Not defined: scoring uses the Base Attack Complexity (AC).
Modified attack requirements (MAT:X): Not defined: scoring uses the Base Attack Requirements (AT).
Modified privileges required (MPR:X): Not defined: scoring uses the Base Privileges Required (PR).
Modified user interaction (MUI:X): Not defined: scoring uses the Base User Interaction (UI).
Modified vulnerable system confidentiality impact (MVC:X): Not defined: scoring uses the Base VC metric.
Modified vulnerable system integrity impact (MVI:X): Not defined: scoring uses the Base VI metric.
Modified vulnerable system availability impact (MVA:X): Not defined: scoring uses the Base VA metric.
Modified subsequent system confidentiality impact (MSC:X): Not defined: scoring uses the Base SC metric.
Modified subsequent system integrity impact (MSI:X): Not defined: scoring uses the Base SI metric.
Modified subsequent system availability impact (MSA:X): Not defined: scoring uses the Base SA metric.
Safety (supplemental) (S:X): Not evaluated.
Automatable (supplemental) (AU:X): Not evaluated.
Recovery (supplemental) (R:X): Not evaluated.
Value density (supplemental) (V:X): Not evaluated.
Vulnerability response effort (supplemental) (RE:X): Not evaluated.
Provider urgency (supplemental) (U:X): Not evaluated.

—

[email protected]

3.3

3.1

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

1.8

1.4

[email protected]

OS Trackers for CVE-2026-4519

vendor	priority	summary	link
`debian`	end-of-life	CVE-2026-4519 end-of-life priority: Debian including 7 source packages (jython, pypy3, …), 18 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 12, resolved 6.	https://security-tracker.debian.org/tracker/CVE-2026-4519
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2026-4519
`suse`	medium	CVE-2026-4519 severity moderate: SUSE including 273 source package names (2.2.1-7.92:libpython3_11-1_0-3.11.15-slfo.1.1_3.1, 2.2.1-7.92:python311-3.11.15-slfo.1.1_3.1, …), 663 product×package rows across 43 product lines (Container suse/sl-micro/6.0/toolbox, Container suse/sl-micro/6.1/baremetal-os-container, … (43 product lines)): Fixed 390, First Fixed 273.	https://www.suse.com/security/cve/CVE-2026-4519/
`ubuntu`	medium	CVE-2026-4519 medium priority: Ubuntu including 14 source packages (jython, pypy3, …), 72 status rows across 8 suites (bionic, focal, jammy, noble, questing, trusty, upstream, xenial): needs-triage 42, DNE 30.	https://ubuntu.com/security/CVE-2026-4519

Affected software / configurations for CVE-2026-4519

Vendor	Product	Version	Raw CPE
python	python	< 3.13.13	cpe:2.3:a:python:python::::::::
python	python	>= 3.14.0, < 3.14.4	cpe:2.3:a:python:python::::::::
python	python	3.15.0	cpe:2.3:a:python:python:3.15.0:alpha1::::::
python	python	3.15.0	cpe:2.3:a:python:python:3.15.0:alpha2::::::
python	python	3.15.0	cpe:2.3:a:python:python:3.15.0:alpha3::::::
python	python	3.15.0	cpe:2.3:a:python:python:3.15.0:alpha4::::::
python	python	3.15.0	cpe:2.3:a:python:python:3.15.0:alpha5::::::
python	python	3.15.0	cpe:2.3:a:python:python:3.15.0:alpha6::::::
python	python	3.15.0	cpe:2.3:a:python:python:3.15.0:alpha7::::::

References for CVE-2026-4519

URL	Tags
https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd	Patch
https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866	Patch
https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e	Patch
https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1	Patch
https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b	Patch
https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4	Patch
https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76	Patch
https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c	Patch
https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5	Patch
https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48	Patch
https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932	Patch
https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03	Patch
https://github.com/python/cpython/issues/143930	Issue Tracking Patch
https://github.com/python/cpython/pull/143931	Issue Tracking Patch
https://mail.python.org/archives/list/[email protected]/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/20/1	Mailing List Third Party Advisory

URL

CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs

Exploit prediction scoring system (EPSS) score for CVE-2026-4519

Common vulnerability scoring system (CVSS) metrics for CVE-2026-4519

Weakness enumeration for CVE-2026-4519

GitHub Security Advisory for CVE-2026-4519

OS Trackers for CVE-2026-4519

Affected software / configurations for CVE-2026-4519

References for CVE-2026-4519