Executive brief
A vulnerability in the Python 'webbrowser' module could allow a malicious URL to be misinterpreted as a command-line instruction. If an application passes an untrusted URL starting with a dash to this module, it might trigger unintended browser behaviors or settings changes rather than simply opening a website. This could potentially be used to bypass security prompts or interfere with how the browser handles the request.
Technical details
A command injection or argument injection vulnerability exists in the Python 'webbrowser' module. The 'webbrowser.open()' function fails to properly validate or sanitize URLs that begin with a dash ('-'). When these URLs are passed to the underlying shell or process execution call to launch a browser, the leading dash causes the browser to interpret the URL as a command-line argument/flag rather than a web address. Attackers who can influence the URL passed to this API could potentially execute arbitrary browser commands. The fix involves updating the module to reject URLs with leading dashes, and developers are advised to sanitize inputs before passing them to this function.
Affected products
- Python Software Foundation CPython 3.10, 3.13, 3.14
Timeline
- 2026-03-20: advisory
- 2026-01-16: patched: Initial security fix commits in CPython repository
References
- https://github.com/python/cpython/commit/3681d47a440865aead912a054d4599087b4270dd
- https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866
- https://github.com/python/cpython/commit/591ed890270c5697b013bf637029fb3e6cd2d73e
- https://github.com/python/cpython/commit/594b5a05dc9913880ac92eded440defbf32a28d1
- https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b
- https://github.com/python/cpython/commit/89bfb8e5ed3c7caa241028f1a4eac5f6275a46a4
- https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76