Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-15760267

[github-actions]

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3 package and not the python3 package as distributed by RHEL.
See How to fix? for RHEL:9 relevant fixed versions and status.

The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open().

Remediation

There is no fixed version for RHEL:9 python3.

References

• https://access.redhat.com/security/cve/CVE-2026-4519
• Reject leading dashes in webbrowser.open() python/cpython#143930
• gh-143930: Reject leading dashes in webbrowser URLs python/cpython#143931
• https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/
• http://www.openwall.com/lists/oss-security/2026/03/20/1
• python/cpython@43fe06b
• python/cpython@82a24a4
• python/cpython@9669a91
• python/cpython@ad4d5ba
• python/cpython@ceac1ef
• python/cpython@cbba611