CVE-2026-4519: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-4519 is an argument injection vulnerability in Python's webbrowser module where the webbrowser.open() API accepted URLs with leading dashes, which certain web browsers could interpret as command-line options rather than URLs. The vulnerability was disclosed on March 20, 2026, and affects CPython versions prior to 3.13.13, versions 3.14.0 through 3.14.4, and 3.15.0 alpha releases up to alpha7. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 7.0 (High) (Red Hat CVE, CPython Issue).

The root cause is improper input validation (CWE-20) and improper neutralization of argument delimiters (CWE-88) in the webbrowser module's _check_url() method, which was absent prior to the fix. When a Python application passes a user-controlled URL to webbrowser.open(), an attacker can supply a string beginning with a dash (e.g., --key=val http://example.com), which the underlying browser subprocess interprets as a command-line flag rather than a URL. The fix, merged on March 20, 2026, adds a _check_url() static method to BaseBrowser that raises a ValueError if the URL starts with a dash after stripping leading whitespace (CPython PR #143931, CPython Commit).

Successful exploitation allows an attacker to inject arbitrary command-line arguments into the browser process launched by the affected Python application, potentially manipulating browser behavior, accessing local files, or executing unintended browser features. The vulnerability has limited confidentiality impact under CVSS v3.1 (integrity: Low, confidentiality: None, availability: None), but CVSS v4.0 rates the vulnerability impact on the vulnerable component as High for both confidentiality and integrity. Exploitation requires local access and user interaction, limiting the scope of impact compared to remotely exploitable vulnerabilities (Red Hat CVE, Feedly).

1. Identify a vulnerable target: Find a Python application (running CPython < 3.13.13, 3.14.x < 3.14.4, or 3.15.0 alpha) that accepts user-supplied input and passes it directly to webbrowser.open() without sanitization.
2. Craft a malicious URL: Construct a URL string beginning with a leading dash, such as --gpu-launcher=id; or --remote-debugging-port=9222, followed by a legitimate URL (e.g., --remote-debugging-port=9222 http://example.com).
3. Trigger the vulnerable code path: Supply the crafted string as input to the application wherever it accepts a URL for browser opening (e.g., a web link field, CLI argument, or configuration value).
4. Browser interprets dashes as flags: The Python webbrowser module passes the string as-is to the browser subprocess; the browser parses the leading dash-prefixed token as a command-line option, potentially enabling unintended browser features or behaviors.
5. Achieve objective: Depending on the browser and injected flag, the attacker may enable remote debugging, load local files, or manipulate browser behavior to exfiltrate data or escalate access (CPython PR #143931, CPython Commit).

• Logs: Python application logs or audit logs showing webbrowser.open calls with URLs beginning with - or -- (Python's sys.audit hook fires webbrowser.open events that can be captured by audit hooks).
• Process: Browser processes (e.g., chrome, firefox, chromium) spawned with unusual command-line arguments such as --remote-debugging-port, --gpu-launcher, or other flag-like strings rather than standard URL arguments.
• Application Errors: ValueError: Invalid URL (leading dash disallowed) exceptions in application logs on patched systems, indicating attempted exploitation (CPython Commit).

Upgrade CPython to a patched version: 3.13.13 or later, 3.14.4 or later, or 3.15.0 beta1 or later. Patches have been backported to branches 3.10, 3.11, 3.12, 3.13, and 3.14 via multiple commits. As an interim workaround, sanitize all URLs before passing them to webbrowser.open() by rejecting or stripping any input that begins with a dash character. Downstream distributions including Red Hat (RHSA-2026:6256, RHSA-2026:6281, and others), AlmaLinux, Fedora, openSUSE, Debian, and Amazon Linux have released updated packages (CPython PR #143931, Red Hat Advisory, Python Security Announce).

The fix was authored by Seth Michael Larson (Python Security Developer-in-Residence) and reviewed by Gregory P. Smith, both core CPython contributors, reflecting a standard coordinated disclosure process within the Python community (CPython PR #143931). The vulnerability was discussed on the oss-security mailing list and announced via the Python security announce list. Social media activity was limited, with brief mentions on Bluesky and Mastodon from infosec tracking accounts. Multiple Linux distributions and enterprise vendors (IBM, Microsoft Azure Linux) issued advisories and updated packages promptly after disclosure (Python Security Announce, IBM Advisory).