Summary
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
* python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)
Bug Fix(es) and Enhancement(s):
* [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | python3.14 | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-debug | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-devel | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-freethreading | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-freethreading-debug | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-freethreading-devel | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-freethreading-idle | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-freethreading-libs | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-freethreading-test | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-freethreading-tkinter | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-idle | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-libs | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-test | 3.14.5-1.el10_2 |
| AlmaLinux · 10 | python3.14-tkinter | 3.14.5-1.el10_2 |
Vulnerabilities 2
-
High 7.0
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
-
Low 2.1
BaseCookie.js_output() does not neutralize embedded characters
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie …