This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-4519 →

ALPINE-CVE-2026-4519

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavi...

Original description

The description as published by the source.

The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open().

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.21 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]

Alpine:v3.22 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]

Alpine:v3.23 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]

References

advisory security.alpinelinux.org