Skip to main content

Cpython EUVDEUVD-2026-13712

| CVE-2026-4519 HIGH
Improper Input Validation (CWE-20)
2026-03-20 PSF
Information Disclosure Cpython Python Software Foundation
High
Disputed · 7.0 Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious URL with leading dashes
  2. Exploit
    Pass unsanitized URL to webbrowser.open()
  3. Execution
    Browser interprets dash as command line option
  4. Impact
    Execute arbitrary commands with user privileges

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

Local attacker must trick a user into executing Python code that calls webbrowser.open() with a crafted URL containing leading dashes. The URL is then passed to a web browser (e.g., Firefox, Chrome) where dashes are interpreted as command-line options, potentially executing arbitrary commands. Requires user interaction and local code execution context.
Impact

While CVSS and EPSS scores are not provided, the risk assessment must rely on the vulnerability characteristics and patch status. The attack vector is network-based or local, depending on how the application obtains the URL. Attack complexity is low, as an attacker need only craft a URL string with a leading dash. This is a logic-based validation flaw rather than a memory corruption issue, making it reliably exploitable. The information disclosure impact is confirmed as the primary concern. No known active exploitation or public POC is indicated in the provided intelligence, but the presence of a published GitHub issue (https://github.com/python/cpython/issues/143930) and official PSF security advisory demonstrates vendor awareness and responsible disclosure. The vulnerability affects a widely-used standard library module in a commonly-deployed language, elevating real-world risk. However, exploitation requires an application to pass untrusted input directly to webbrowser.open() without sanitization, which is a secondary control failure. Given patch availability from the vendor and the requirement for application-level misuse, this should be prioritized for patching but is not an emergency critical vulnerability; organizations should treat this as a medium-priority update in standard maintenance cycles.
Exploit ScenarioDerived

An attacker crafts a malicious URL such as 'webbrowser.open("-P /tmp/attacker-profile")' or similar, with a leading dash. When an application passes this unsanitized URL to webbrowser.open(), the browser interprets the leading dash as a command-line flag and may execute unintended behavior, such as loading an alternate browser profile containing attacker-controlled data or dumping sensitive browser state information. The attack requires either social engineering (convincing a user to click a link that triggers the vulnerable code) or an application that processes untrusted URLs; exploitation is straightforward once a vulnerable code path is identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 20, 2026

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-line options rather than URLs, potentially leading to unintended command execution or information disclosure. This affects all CPython versions using the vulnerable webbrowser module. An attacker can craft a malicious URL containing leading dashes (e.g., '-P' or '--profile') that, when passed to webbrowser.open(), may trigger browser-specific behavior such as loading alternate profiles or executing browser commands, resulting in information disclosure or other security impacts.

RemediationAI

Upgrade to the latest patched version of CPython that includes the fix for webbrowser.open() URL validation, as provided by the Python Software Foundation. Consult the official security advisory at https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ and the CPython GitHub repository (https://github.com/python/cpython/pull/143931) for exact version information. As an immediate workaround, applications using webbrowser.open() should implement input validation to sanitize URLs and reject any URLs containing leading dashes before passing them to the API; the PSF recommends that users sanitize URLs prior to passing them to webbrowser.open(). Organizations should prioritize patching in their standard update cycles, particularly for production systems where user-controlled URLs may be processed.

Affected VersionsENISA

CPython 0 <3.15.0

Affected Packages

euvd cpython fix: 3.15.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in CPython's webbrowser module, which is responsible for opening URLs in the user's default web browser. The root cause is improper input validation of the URL parameter before passing it to the underlying browser executable. Many command-line applications, including web browsers like Firefox and Chrome, interpret arguments beginning with dashes as command-line flags rather than positional arguments. The affected product is CPython (cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*), which means all versions of the CPython interpreter are affected unless patched. The underlying issue relates to insufficient sanitization of user-supplied input before use in system operations, a classic command-injection attack vector. The PSF patch (available at https://github.com/python/cpython/pull/143931) implements validation to reject URLs with leading dashes, preventing their interpretation as command-line options by downstream browser processes.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (PSF) PRIMARY 7.0 HIGH
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 3.3 LOW
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Red Hat 7.1 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: PSF

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Mar 20, 2026 - 15:15 nvd
Patch available
CVE Published
Mar 20, 2026 - 15:08 nvd
HIGH 7.0

DescriptionCVE.org

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

Executive ViewAI

Why It Matters

CVE-2026-4519 presents moderate security risk, a input validation vulnerability rated CVSS 7.0. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: Moderate
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-115557 CRITICAL
9.4 Oct 24

CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-114583 MEDIUM
6.9 Oct 22

CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archi
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Debian

jython
Release Status Fixed Version Urgency
bullseye vulnerable 2.7.2+repack1-3 -
forky, sid, bookworm, trixie vulnerable 2.7.3+repack1-1 -
(unstable) fixed (unfixed) -
pypy3
Release Status Fixed Version Urgency
bullseye vulnerable 7.3.5+dfsg-2+deb11u2 -
bullseye (security) vulnerable 7.3.5+dfsg-2+deb11u5 -
bookworm vulnerable 7.3.11+dfsg-2+deb12u3 -
trixie vulnerable 7.3.19+dfsg-2 -
forky vulnerable 7.3.20+dfsg-4 -
sid vulnerable 7.3.21+dfsg-2 -
(unstable) fixed (unfixed) -
python2.7
Release Status Fixed Version Urgency
bullseye vulnerable 2.7.18-8+deb11u1 -
(unstable) fixed (unfixed) -
python3.11
Release Status Fixed Version Urgency
bookworm vulnerable 3.11.2-6+deb12u6 -
bookworm (security) vulnerable 3.11.2-6+deb12u3 -
(unstable) fixed (unfixed) -
python3.13
Release Status Fixed Version Urgency
trixie vulnerable 3.13.5-2 -
forky, sid vulnerable 3.13.12-1 -
(unstable) fixed (unfixed) -
python3.14
Release Status Fixed Version Urgency
forky, sid vulnerable 3.14.3-2 -
(unstable) fixed (unfixed) -
python3.9
Release Status Fixed Version Urgency
bullseye vulnerable 3.9.2-1 -
bullseye (security) vulnerable 3.9.2-1+deb11u5 -
(unstable) fixed (unfixed) -

SUSE

Severity: Low
Product Status
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.92 Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/143931 ADVISORY https://access.redhat.com/errata/RHSA-2026:6256 ADVISORY https://access.redhat.com/errata/RHSA-2026:6281 ADVISORY https://access.redhat.com/errata/RHSA-2026:6283 ADVISORY https://access.redhat.com/errata/RHSA-2026:6285 ADVISORY https://access.redhat.com/errata/RHSA-2026:6286 ADVISORY https://access.redhat.com/errata/RHSA-2026:6473 ADVISORY https://access.redhat.com/errata/RHSA-2026:6766 ADVISORY https://access.redhat.com/errata/RHSA-2026:7010 ADVISORY https://access.redhat.com/errata/RHSA-2026:7244 ADVISORY https://access.redhat.com/errata/RHSA-2026:7329 ADVISORY https://access.redhat.com/errata/RHSA-2026:7335 ADVISORY https://access.redhat.com/errata/RHSA-2026:8746 ADVISORY https://access.redhat.com/errata/RHSA-2026:8747 ADVISORY https://access.redhat.com/errata/RHSA-2026:8748 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4519 ADVISORY https://ubuntu.com/security/notices/USN-8509-1 ADVISORY https://vuldb.com/?id.352090 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1206/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1292/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1296/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1345/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1349/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1354/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1376/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1385/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1417/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21104/ REF http://www.openwall.com/lists/oss-security/2026/03/20/1 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:10101 REF https://access.redhat.com/errata/RHSA-2026:10102 REF https://access.redhat.com/errata/RHSA-2026:10111 REF https://access.redhat.com/errata/RHSA-2026:10140 REF https://access.redhat.com/errata/RHSA-2026:10141 REF https://access.redhat.com/errata/RHSA-2026:13812 REF https://access.redhat.com/errata/RHSA-2026:16008 REF https://access.redhat.com/errata/RHSA-2026:16009 REF https://access.redhat.com/errata/RHSA-2026:16030 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:19019 REF https://access.redhat.com/errata/RHSA-2026:19064 REF https://access.redhat.com/errata/RHSA-2026:19175 REF https://access.redhat.com/errata/RHSA-2026:19176 REF https://access.redhat.com/errata/RHSA-2026:19177 REF https://access.redhat.com/errata/RHSA-2026:19216 REF https://access.redhat.com/errata/RHSA-2026:19724 REF https://access.redhat.com/errata/RHSA-2026:19725 REF https://access.redhat.com/errata/RHSA-2026:21275 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:6016 REF https://access.redhat.com/errata/RHSA-2026:6035 REF https://access.redhat.com/errata/RHSA-2026:7443 REF https://access.redhat.com/errata/RHSA-2026:7661 REF https://access.redhat.com/errata/RHSA-2026:9042 REF https://access.redhat.com/errata/RHSA-2026:9260 REF https://access.redhat.com/errata/RHSA-2026:9261 REF https://access.redhat.com/errata/RHSA-2026:9262 REF https://access.redhat.com/errata/RHSA-2026:9289 REF https://access.redhat.com/errata/RHSA-2026:9354 REF https://access.redhat.com/errata/RHSA-2026:9386 REF https://access.redhat.com/errata/RHSA-2026:9387 REF https://access.redhat.com/errata/RHSA-2026:9591 REF https://access.redhat.com/errata/RHSA-2026:9614 REF https://access.redhat.com/errata/RHSA-2026:9621 REF https://access.redhat.com/errata/RHSA-2026:9705 REF https://access.redhat.com/errata/RHSA-2026:9745 REF https://access.redhat.com/security/cve/CVE-2026-4519 REF https://bugzilla.redhat.com/show_bug.cgi?id=2449649 REF https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd REF https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866 REF https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e REF https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1 REF https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b REF https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4 REF https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76 REF https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c REF https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5 REF https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48 REF https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932 REF https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03 REF https://github.com/python/cpython/issues/143930 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4519.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy