The vulnerability CVE-2026-4519 affects CPython's webbrowser.open() API, which previously accepted URLs starting with leading dashes. Such URLs could be misinterpreted as command line options by some web browsers, creating a risk of command-line option injection. The Python Software Foundation has updated the behavior to reject URLs with leading dashes to mitigate this risk. The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-88 (Argument Injection or Modification). Red Hat has issued security advisories and patches addressing this issue in their Extended Life Cycle Support for Python packages. The vulnerability has a CVSS 4.0 base score of 7.0, indicating high severity. No known exploits in the wild have been reported.

If exploited, this vulnerability could allow an attacker to inject command-line options into web browsers launched via the webbrowser.open() API by passing crafted URLs with leading dashes. This could potentially alter browser behavior or cause unintended command execution. The impact is rated high due to the possibility of partial control over browser invocation parameters. However, there are no reports of active exploitation in the wild.

A fix is available and has been incorporated in updated Python packages distributed by vendors such as Red Hat. Users should apply the official patches provided by their operating system or Python distribution vendors. Additionally, users are recommended to sanitize URLs to ensure they do not start with leading dashes before passing them to webbrowser.open(). Refer to the Red Hat advisory RHSA-2026:10102 for patch details and update instructions. Patch status is confirmed by vendor advisories.