UpHeron
All vulnerabilities

Servers and applications

CVE-2026-4519

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Severity
High 7.0
Published
20 Mar 2026
Last changed
13 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.13.13, 3.14.4
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha4
All 9 release lines
  • Every version before 3.13.13
  • From 3.14.0 before 3.14.4
  • Version 3.15.0-alpha1
  • Version 3.15.0-alpha2
  • Version 3.15.0-alpha3
  • Version 3.15.0-alpha4
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-4519
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4519