{
  "schema_version": "1.5.0",
  "id": "PSF-2026-14",
  "published": "2026-03-20T15:08:32.576Z",
  "modified": "2026-04-07T22:01:57.205Z",
  "aliases": [
    "CVE-2026-4519"
  ],
  "details": "The webbrowser.open() API would accept leading dashes in the URL which \ncould be handled as command line options for certain web browsers. New \nbehavior rejects leading dashes. Users are recommended to sanitize URLs \nprior to passing to webbrowser.open().",
  "affected": [
    {
      "ranges": [
        {
          "type": "GIT",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "43fe06b96f6a6cf5cfd5bdab20b8649374956866"
            },
            {
              "fixed": "82a24a4442312bdcfc4c799885e8b3e00990f02b"
            },
            {
              "fixed": "9669a912a0e329c094e992204d6bdb8787024d76"
            },
            {
              "fixed": "ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5"
            },
            {
              "fixed": "ceac1efc66516ac387eef2c9a0ce671895b44f03"
            },
            {
              "fixed": "cbba6119391112aba9c5aebf7b94aea447922c48"
            },
            {
              "fixed": "3681d47a440865aead912a054d4599087b4270dd"
            },
            {
              "fixed": "591ed890270c5697b013bf637029fb3e6cd2d73e"
            },
            {
              "fixed": "594b5a05dc9913880ac92eded440defbf32a28d1"
            },
            {
              "fixed": "89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4"
            },
            {
              "fixed": "96fc5048605863c7b6fd6289643feb0e97edd96c"
            },
            {
              "fixed": "cc023511238ad93ecc8796157c6f9139a2bb2932"
            }
          ],
          "repo": "https://github.com/python/cpython"
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/pull/143931"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/python/cpython/issues/143930"
    },
    {
      "type": "ADVISORY",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb0e97edd96c"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python/cpython/commit/cc023511238ad93ecc8796157c6f9139a2bb2932"
    }
  ],
  "database_specific": {
    "cwe_ids": []
  }
}