[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a561c833-da09-40f9-b8c4-9aad4f5dc12e@oracle.com>
Date: Fri, 20 Mar 2026 12:00:10 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: [CPython][CVE-2026-4519] webbrowser.open() API
allows leading dashes
-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-4519] webbrowser.open() API allows
leading dashes
Date: Fri, 20 Mar 2026 15:03:34 +0000
From: Seth Larson <seth@...hon.org>
Reply-To: security-sig@...hon.org
To: security-announce@...hon.org
There is a MEDIUM severity vulnerability affecting CPython.
The webbrowser.open() API would accept leading dashes in the URL which could be
handled as command line options for certain web browsers. New behavior rejects
leading dashes. Users are recommended to sanitize URLs prior to passing to
webbrowser.open().
Please see the linked CVE ID for the latest information on affected versions:
* https://www.cve.org/CVERecord?id=CVE-2026-4519
* https://github.com/python/cpython/pull/143931
_______________________________________________
Security-announce mailing list -- security-announce@...hon.org
https://mail.python.org/mailman3//lists/security-announce.python.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
