CVE-2026-4519

CVE-2026-4519 describes a vulnerability in the `webbrowser.open()` API, part of Python's standard library, where it improperly accepts URLs containing leading dashes. This flaw allows certain web browsers to interpret these dashes as command-line options, potentially leading to high confidentiality and integrity impacts on a user's system. Rated High with a CVSSv4 score of 7.0, exploitation requires local access and user interaction, though the attack complexity is low. Currently, there is no evidence of active exploitation, nor are public exploit modules available, and community attention remains minimal. Users are advised to sanitize URLs before passing them to `webbrowser.open()` to mitigate this risk.