Nixpkgs Security Tracker

Untriaged

Permalink CVE-2026-4519

created 1 day, 19 hours ago

webbrowser.open() allows leading dashes in URLs

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

References

https://github.com/python/cpython/pull/143931 patch
https://github.com/python/cpython/issues/143930 issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/AY5ND… vendor-advisory
http://www.openwall.com/lists/oss-security/2026/03/20/1

Affected products

CPython

<3.15.0

Matching in nixpkgs

pkgs.haskellPackages.cpython

Bindings for libpython

nixos-unstable 3.9.0
- nixpkgs-unstable 3.9.0
- nixos-unstable-small 3.9.0
nixos-25.11 3.9.0
- nixos-25.11-small 3.9.0
- nixpkgs-25.11-darwin 3.9.0

Package maintainers

@sheepforce Phillip Seeber <phillip.seeber@googlemail.com>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.haskellPackages.cpython

Package maintainers