The vulnerability in CPython's webbrowser.open() API arises because it does not sanitize URLs that begin with leading dashes. When such URLs are passed to certain web browsers, these dashes can be interpreted as command-line options, potentially allowing an attacker to execute unintended commands or code, read or modify application data, or cause other unintended behavior. This is classified under CWE-20 (Improper Input Validation) and CWE-88 (Argument Injection). The issue affects Python versions 3.11.0, 3.12.0, 3.13.0, 3.14.0, and 3.15.0a1. Red Hat has released security advisories and patches for their affected products, including Red Hat Enterprise Linux 6 Extended Lifecycle Support. The vulnerability has a CVSS v3 base score of 7.0 (high severity) with network attack vector, low attack complexity, no privileges required, and user interaction required.

An attacker can craft a malicious URL containing leading dashes that, when opened via the webbrowser.open() API, may be interpreted by certain web browsers as command-line options. This can lead to unexpected behavior such as information disclosure, arbitrary code execution, or modification of application data, impacting system integrity and confidentiality. The vulnerability does not require privileges but does require user interaction. There are no known exploits in the wild at this time.

A security update fixing this vulnerability is available from the Python Software Foundation and has been packaged by Red Hat for affected products. Users are advised to apply the vendor-provided patches promptly. Currently, no alternative mitigations meet Red Hat's criteria for ease of use and applicability. Users should sanitize URLs before passing them to webbrowser.open() as a precaution. For Red Hat Enterprise Linux 6 Extended Lifecycle Support users, updated python packages are available as per RHSA-2026:10102. Check the vendor advisory for detailed update instructions.