CVE-2026-4519 identifies a vulnerability in the Python Software Foundation's CPython implementation, specifically within the webbrowser.open() API. The issue arises because the API previously accepted URLs beginning with leading dashes ('-'). Certain web browsers interpret such leading dashes as command line options rather than as part of the URL. This can cause the browser to process these inputs as command line arguments, potentially altering browser behavior or enabling unintended command execution scenarios. The new behavior introduced in CPython rejects URLs with leading dashes to prevent this ambiguity. The vulnerability requires local access with low privileges and partial authentication, and does not require user interaction. The CVSS 4.0 score is 5.7 (medium severity), reflecting moderate impact on integrity and availability, with a high attack complexity and partial authentication required. No known exploits have been reported in the wild, and no patches or updates are explicitly linked, but users are recommended to sanitize URLs before passing them to webbrowser.open() to avoid this issue. This vulnerability primarily affects applications and scripts that invoke webbrowser.open() with untrusted or unsanitized URL inputs, potentially leading to command line injection or unexpected browser behavior.

The vulnerability could allow an attacker who can influence the URL passed to webbrowser.open() to cause the browser to interpret the URL as command line options. This may lead to unintended browser behavior, potentially impacting the integrity and availability of the system or browser session. While the attack complexity is high and partial authentication is required, the impact could be significant in environments where Python scripts are used to automate browser launches with user-supplied URLs, such as in automated testing, web scraping, or internal tooling. Exploitation could disrupt normal operations or enable further attacks if combined with other vulnerabilities. Since the vulnerability does not allow direct remote exploitation and requires local privileges, the overall risk is moderate but should not be ignored in sensitive environments.

To mitigate this vulnerability, developers should sanitize and validate all URLs before passing them to webbrowser.open(), explicitly rejecting or removing leading dashes. Implement input validation routines that enforce strict URL formatting and reject malformed or suspicious inputs. Update CPython to the latest version where the behavior rejecting leading dashes is implemented. Avoid passing user-controlled or untrusted URLs directly to webbrowser.open() without proper sanitization. Additionally, consider running Python scripts with the least privileges necessary and monitor for unusual browser behaviors or command line invocations. Employ application whitelisting and endpoint protection to detect anomalous command executions triggered by browser launches. Regularly review and audit codebases that use webbrowser.open() to ensure compliance with these practices.