Description
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
Affected products
python: python
References10
- mail.python.org/archives/list/[email protected]/thre… Vendor Advisory
- github.com/python/cpython/commit/3681d47a440865aead912a054d4599… Patch
- github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b864… Patch
- github.com/python/cpython/commit/591ed890270c5697b013bf637029fb… Patch
- github.com/python/cpython/commit/594b5a05dc9913880ac92eded440de… Patch
- github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3… Patch
- github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5… Patch
- github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb… Patch
- github.com/python/cpython/commit/96fc5048605863c7b6fd6289643feb… Patch
- github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203b… Patch
Metrics
- CVSS 3.1
-
3.3
LOW
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 4.0
-
7.0
HIGH
Score source: CNA
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 25 · as of 12 November 2026
- CWE
- CWE-20CWE-88
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.