CVE-2026-4519

score

<0.1

cvss

3.3

epss

0.3%

published

2026-03-20

kev added

—

first seen

2026-10-21

Python webbrowser module contains a command injection vulnerability caused by accepting leading dashes in URLs passed to webbrowser.open(), letting attackers execute arbitrary commands via crafted URLs, exploit requires attacker to control URL input.