CVE-Katalog

CVE-2026-4519

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended t

[CVE-Katalog]

Schweregrad: High · CVSS 7.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Published: Mar 20, 2026, 3:16:24 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.31% · Oct 22, 2026

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pypy3	sid	`8.0.1+dfsg-1`	fixed
Debian	pypy3	forky	`8.0.1+dfsg-1`	fixed
Debian	pypy3	trixie	`7.3.19+dfsg-2`	vulnerable
Debian	pypy3	bookworm	`7.3.11+dfsg-2+deb12u3`	vulnerable
Debian	jython	sid	`2.7.3+repack1-1`	vulnerable
Debian	jython	forky	`2.7.3+repack1-1`	vulnerable
Debian	jython	trixie	`2.7.3+repack1-1`	vulnerable
Debian	jython	bookworm	`2.7.3+repack1-1`	vulnerable
Debian	python3.11	bookworm	`3.11.2-6+deb12u8`	fixed
Debian	python3.11	bookworm-security	`3.11.2-6+deb12u9`	fixed
Cpe	jython	Not reported	Not reported	vulnerable
Cpe	pypy3	Not reported	Not reported	vulnerable
Cpe	python3.11	Not reported	`3.11.2-6+deb12u8`	fixed
Cpe	python3.12	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	idle-python3.12	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-dev	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-minimal	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-stdlib	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-testsuite	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12t64	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-dev	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-doc	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-examples	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-full	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-minimal	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-nopie	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-venv	Not reported	`3.12.3-1ubuntu0.15`	fixed
Alpine	python3	3.21	`3.12.14-r0`	fixed
Alpine	python3	3.22	`3.12.14-r0`	fixed
Alpine	python3	3.23	`3.12.14-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pypy3	source	sid	`7.3.22+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	pypy3	source	forky	`7.3.22+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	pypy3	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	pypy3	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	jython	source	sid	`(unfixed)`	not yet assigned	Not reported	[1136197]
Debian	jython	source	forky	`(unfixed)`	not yet assigned	Not reported	[1136197]
Debian	jython	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1136197]
Debian	jython	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1136197]
Debian	python3.11	source	bookworm	`3.11.2-6+deb12u8`	not yet assigned	Not reported	Not reported
Cpe	python3.11	cpe	Not reported	`3.11.2-6+deb12u8`	Not reported	Not reported	Not reported
Cpe	python3.12	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	idle-python3.12	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-dev	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-minimal	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-stdlib	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-testsuite	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12t64	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-dev	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-doc	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-examples	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-full	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-minimal	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-nopie	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-venv	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Alpine	python3	apk	3.21	`3.12.14-r0`	Not reported	ALPINE-CVE-2026-4519	Not reported
Alpine	python3	apk	3.22	`3.12.14-r0`	Not reported	ALPINE-CVE-2026-4519	Not reported
Alpine	python3	apk	3.23	`3.12.14-r0`	Not reported	ALPINE-CVE-2026-4519	Not reported

[Debian bug #1136197]

Notes

[trixie] pypy3: Minor issue [bookworm] pypy3: Minor issue [trixie] jython: Minor issue [bookworm] jython: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[idle-python3.11]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[jython]Betroffen
Details (2)
- 2.7.3+repack1-1 · all · bookworm
  Betroffen
  nvd · jython · debian · bookworm; nvd · jython · debian · 12
- 2.7.3+repack1-1 · all · bookworm
  Betroffen
  nvd · jython · debian · bookworm; nvd · jython · debian · 12
[jython-doc]Betroffen
Quellpaket: [jython]
Details (2)
- 2.7.3+repack1-1 · all · bookworm
  Betroffen
  nvd · jython · debian · bookworm; nvd · jython · debian · 12
- 2.7.3+repack1-1 · all · bookworm
  Betroffen
  nvd · jython · debian · bookworm; nvd · jython · debian · 12
[libpython3.11]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-dbg]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-dev]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-minimal]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-stdlib]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-testsuite]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[pypy3]Betroffen
Details (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-dev]Betroffen
Quellpaket: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-doc]Betroffen
Quellpaket: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-lib]Betroffen
Quellpaket: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-lib-testsuite]Betroffen
Quellpaket: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-tk]Betroffen
Quellpaket: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[pypy3-venv]Betroffen
Quellpaket: [pypy3]
Details (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Betroffen
  nvd · pypy3 · debian · bookworm; nvd · pypy3 · debian · 12
[python3.11]Betroffen
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-dbg]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-dev]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-doc]Betroffen
Quellpaket: [python3.11]
Details (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Behoben · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Betroffen · Behoben: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12

Weitere Ergebnisse

Beobachtet: Oct 23, 2026, 10:39:44 PM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]