Bug 2449649 (CVE-2026-4519)

Summary:	CVE-2026-4519 python: Python: Command-line option injection in webbrowser.open() via crafted URLs
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bbrownin, dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2449722, 2449724, 2449726, 2449723, 2449725, 2449727, 2449728, 2449729, 2449730, 2449731, 2449733, 2449735
Bug Blocks:

Description OSIDB Bzimport 2026-03-20 16:03:17 UTC

The webbrowser.open() API would accept leading dashes in the URL which 
could be handled as command line options for certain web browsers. New 
behavior rejects leading dashes. Users are recommended to sanitize URLs 
prior to passing to webbrowser.open().

Comment 2 errata-xmlrpc 2026-03-31 09:48:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:6256 https://access.redhat.com/errata/RHSA-2026:6256

Comment 3 errata-xmlrpc 2026-03-31 16:28:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:6281 https://access.redhat.com/errata/RHSA-2026:6281

Comment 4 errata-xmlrpc 2026-03-31 16:54:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:6283 https://access.redhat.com/errata/RHSA-2026:6283

Comment 5 errata-xmlrpc 2026-03-31 17:18:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:6286 https://access.redhat.com/errata/RHSA-2026:6286

Comment 6 errata-xmlrpc 2026-03-31 17:18:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:6285 https://access.redhat.com/errata/RHSA-2026:6285

Comment 7 errata-xmlrpc 2026-04-02 13:59:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:6473 https://access.redhat.com/errata/RHSA-2026:6473

Comment 8 errata-xmlrpc 2026-04-07 11:11:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:6766 https://access.redhat.com/errata/RHSA-2026:6766

Comment 9 errata-xmlrpc 2026-04-08 13:57:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:7010 https://access.redhat.com/errata/RHSA-2026:7010

Comment 10 errata-xmlrpc 2026-04-09 08:23:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:7244 https://access.redhat.com/errata/RHSA-2026:7244

Comment 11 errata-xmlrpc 2026-04-20 14:04:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:9042 https://access.redhat.com/errata/RHSA-2026:9042

Comment 12 errata-xmlrpc 2026-04-21 11:37:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:9261 https://access.redhat.com/errata/RHSA-2026:9261

Comment 13 errata-xmlrpc 2026-04-21 11:40:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:9260 https://access.redhat.com/errata/RHSA-2026:9260

Comment 14 errata-xmlrpc 2026-04-21 11:53:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:9262 https://access.redhat.com/errata/RHSA-2026:9262

Comment 15 errata-xmlrpc 2026-04-21 14:24:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:9289 https://access.redhat.com/errata/RHSA-2026:9289

Comment 16 errata-xmlrpc 2026-04-21 15:12:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:9354 https://access.redhat.com/errata/RHSA-2026:9354

Comment 17 errata-xmlrpc 2026-04-21 15:35:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:9387 https://access.redhat.com/errata/RHSA-2026:9387

Comment 18 errata-xmlrpc 2026-04-21 16:18:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:9386 https://access.redhat.com/errata/RHSA-2026:9386

Comment 19 errata-xmlrpc 2026-04-22 06:05:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:9591 https://access.redhat.com/errata/RHSA-2026:9591

Comment 20 errata-xmlrpc 2026-04-22 07:02:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:9614 https://access.redhat.com/errata/RHSA-2026:9614

Comment 21 errata-xmlrpc 2026-04-22 07:08:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:9621 https://access.redhat.com/errata/RHSA-2026:9621

Comment 22 errata-xmlrpc 2026-04-22 13:56:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:9705 https://access.redhat.com/errata/RHSA-2026:9705

Comment 23 errata-xmlrpc 2026-04-22 15:34:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:9745 https://access.redhat.com/errata/RHSA-2026:9745

Comment 24 errata-xmlrpc 2026-04-23 14:59:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION

Via RHSA-2026:10102 https://access.redhat.com/errata/RHSA-2026:10102

Comment 25 errata-xmlrpc 2026-04-23 16:20:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:10101 https://access.redhat.com/errata/RHSA-2026:10101

Comment 26 errata-xmlrpc 2026-04-23 18:12:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:10111 https://access.redhat.com/errata/RHSA-2026:10111

Comment 27 errata-xmlrpc 2026-05-05 17:49:50 UTC

This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2026:13812 https://access.redhat.com/errata/RHSA-2026:13812

Comment 30 errata-xmlrpc 2026-05-19 13:02:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19019 https://access.redhat.com/errata/RHSA-2026:19019

Comment 31 errata-xmlrpc 2026-05-19 13:07:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19064 https://access.redhat.com/errata/RHSA-2026:19064

Comment 32 errata-xmlrpc 2026-05-19 17:58:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19175 https://access.redhat.com/errata/RHSA-2026:19175

Comment 33 errata-xmlrpc 2026-05-19 17:59:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19176 https://access.redhat.com/errata/RHSA-2026:19176

Comment 34 errata-xmlrpc 2026-05-19 17:59:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19177 https://access.redhat.com/errata/RHSA-2026:19177

Comment 35 errata-xmlrpc 2026-05-19 18:02:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19216 https://access.redhat.com/errata/RHSA-2026:19216