Skip to content
OpenAdvisories

Description

The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open().

Affected products

VendorProductAffectedFixed
Python Software Foundation CPython < 3.10.21, 3.11.0 – < 3.11.16, 3.12.0 – < 3.12.14, 3.13.0 – < 3.13.13, 3.14.0 – < 3.14.4, 3.15.0a1 – < 3.15.0a8 3.10.21

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jython No fix yet —
Debian 14 pypy3 7.3.22+dfsg-1 —
Debian 14 python3.14 3.14.4-1 —
Debian 13 pypy3 +1 No fix yet —
Debian 13 python3.13 3.13.5-2+deb13u2 —
Debian 12 pypy3 +1 No fix yet —
Debian 12 python3.11 3.11.2-6+deb12u8 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pypy3 +1 No fix yet —
Ubuntu 26.04 LTS pypy3 +1 No fix yet —
Ubuntu 26.04 LTS python3.14 3.14.4-1ubuntu0.1 USN-8509-1
Ubuntu 25.10 pypy3 +3 No fix yet —
Ubuntu 24.04 LTS pypy3 +1 No fix yet —
Ubuntu 24.04 LTS python3.12 3.12.3-1ubuntu0.15 USN-8509-1
Ubuntu 22.04 LTS pypy3 +1 No fix yet —
Ubuntu 22.04 LTS python3.10 3.10.12-1~22.04.16 USN-8509-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS pypy3 +1 No fix yet —
Ubuntu 18.04 LTS jython No fix yet —
Ubuntu 16.04 LTS jython No fix yet —
Ubuntu Pro 22.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 20.04 LTS python2.7 +2 No fix yet —
Ubuntu Pro 18.04 LTS python2.7 +3 No fix yet —
Ubuntu Pro 16.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 14.04 LTS python2.7 +2 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 python3 +8 3.12.12-3.el10_1.2 RHSA-2026:19064, RHSA-2026:6256
RHEL 10 python3.14 +13 3.14.4-2.el10_2 RHSA-2026:19019
RHEL 9 python3 +8 3.9.25-3.el9_7.2 RHSA-2026:19216, RHSA-2026:6766
RHEL 9 python3.11 +6 3.11.13-5.2.el9_7 RHSA-2026:19175, RHSA-2026:6286
RHEL 9 python3.12 +6 3.12.12-4.el9_7.2 RHSA-2026:19177, RHSA-2026:6285
RHEL 9 python3.14 +13 3.14.4-2.el9_8 RHSA-2026:19176
RHEL 8 python3 +7 3.6.8-75.el8_10 RHSA-2026:6473
RHEL 8 python3.11 +7 3.11.13-6.el8_10 RHSA-2026:6281
RHEL 8 python3.12 +7 3.12.12-4.el8_10 RHSA-2026:6283
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS python3 +8 3.12.9-2.el10_0.8 RHSA-2026:7244
RHEL 9.6 EUS python3 +8 3.9.21-2.el9_6.5 RHSA-2026:9354
RHEL 9.6 EUS python3.11 +6 3.11.11-2.el9_6.6 RHSA-2026:9705
RHEL 9.6 EUS python3.12 +6 3.12.9-1.el9_6.7 RHSA-2026:7010
RHEL 9.4 EUS python3 +8 3.9.18-3.el9_4.12 RHSA-2026:10101
RHEL 9.4 EUS python3.11 +6 3.11.7-1.el9_4.12 RHSA-2026:9042
RHEL 9.4 EUS python3.12 +6 3.12.1-4.el9_4.12 RHSA-2026:10111
RHEL 9.2 E4S python3 +5 3.9.16-1.el9_2.13 RHSA-2026:9262
RHEL 9.2 E4S python3.11 +3 3.11.2-2.el9_2.11 RHSA-2026:9260
RHEL 9.0 E4S python3 +5 3.9.10-4.el9_0.10 RHSA-2026:9261
RHEL 8.8 TUS python3 +7 3.6.8-51.el8_8.14 RHSA-2026:9289
RHEL 8.8 TUS python3.11 +4 3.11.2-2.el8_8.9 RHSA-2026:9591
RHEL 8.8 E4S python3 +7 3.6.8-51.el8_8.14 RHSA-2026:9289
RHEL 8.8 E4S python3.11 +4 3.11.2-2.el8_8.9 RHSA-2026:9591
RHEL 8.6 TUS python3 +7 3.6.8-47.el8_6.12 RHSA-2026:9386
RHEL 8.6 E4S python3 +7 3.6.8-47.el8_6.12 RHSA-2026:9386
RHEL 8.6 AUS python3 +7 3.6.8-47.el8_6.12 RHSA-2026:9386
RHEL 8.4 EUS Long Life python3 +7 3.6.8-39.el8_4.10 RHSA-2026:9621
RHEL 8.4 AUS python3 +7 3.6.8-39.el8_4.10 RHSA-2026:9621
RHEL 8.2 AUS python3 +7 3.6.8-24.el8_2.7 RHSA-2026:9387
RHEL 7 ELS python +6 2.7.5-94.el7_9.4 RHSA-2026:9614
RHEL 7 ELS python3 +6 3.6.8-21.el7_9.5 RHSA-2026:9745
RHEL 6 ELS python +5 2.6.6-70.el6_10.3 RHSA-2026:10102
Red Hat Hardened Images 1 python3 +15 3.14.4-1.hum1 RHSA-2026:7661
Red Hat Hardened Images 1 python3.11 +6 3.11.15-2.hum1 RHSA-2026:6016
Red Hat Hardened Images 1 python3.12 +6 3.12.13-2.hum1 RHSA-2026:6035
Red Hat Hardened Images 1 python3.13 +8 3.13.13-1.hum1 RHSA-2026:7443

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python-unversioned-command 3.12.12-3.el10_1.2 ALSA-2026:19064, ALSA-2026:6256
AlmaLinux 10 python3 +6 3.12.13-2.el10_2 ALSA-2026:19064
AlmaLinux 10 python3.14 +13 3.14.4-2.el10_2 ALSA-2026:19019
AlmaLinux 9 python3 +7 3.9.25-3.el9_7.2 ALSA-2026:19216, ALSA-2026:6766
AlmaLinux 9 python3.11 +6 3.11.13-5.2.el9_7 ALSA-2026:19175, ALSA-2026:6286
AlmaLinux 9 python3.12 +6 3.12.12-4.el9_7.2 ALSA-2026:19177, ALSA-2026:6285
AlmaLinux 9 python3.14 +13 3.14.4-2.el9_8 ALSA-2026:19176
AlmaLinux 8 python3-idle +6 3.6.8-75.el8_10.alma.1 ALSA-2026:6473
AlmaLinux 8 python3.11 +7 3.11.13-6.el8_10 ALSA-2026:6281
AlmaLinux 8 python3.12 +7 3.12.12-4.el8_10 ALSA-2026:6283

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python3.12 3.12.13-2.el10_2 RLSA-2026:19064
Rocky Linux 10 python3.14 3.14.4-2.el10_2 RLSA-2026:19019
Rocky Linux 9 python3.11 3.11.13-5.2.el9_7 RLSA-2026:19175, RLSA-2026:6286
Rocky Linux 9 python3.12 3.12.12-4.el9_7.2 RLSA-2026:19177, RLSA-2026:6285
Rocky Linux 9 python3.14 3.14.4-2.el9_8 RLSA-2026:19176
Rocky Linux 9 python3.9 3.9.25-3.el9_7.2 RLSA-2026:19216, RLSA-2026:6766
Rocky Linux 8 python3 3.6.8-75.el8_10.rocky.0 RLSA-2026:6473
Rocky Linux 8 python3.11 3.11.13-6.el8_10 RLSA-2026:6281
Rocky Linux 8 python3.12 3.12.12-4.el8_10 RLSA-2026:6283
ReleasePackageFixed inAdvisory
SLES 15 SP7 python +1 2.7.18-150000.111.1 SUSE-SU-2026:1206-1
SLES 15 SP7 python311-core 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES 15 SP6 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES 15 SP6 python312 +1 3.12.13-150600.3.53.1 SUSE-SU-2026:4534-1, SUSE-SU-2026:1292-1
SLES 15 SP5 python311 +2 3.11.15-150400.9.85.1 SUSE-SU-2026:1530-1
SLES 15 SP5 python39 +1 3.9.25-150300.4.99.1 SUSE-SU-2026:1296-1
SLES 15 SP4 python310 +1 3.10.20-150400.4.107.1 SUSE-SU-2026:1376-1
SLES 15 SP4 python311 +2 3.11.15-150400.9.85.1 SUSE-SU-2026:1530-1
SLES 12 SP5 python +2 2.7.18-33.74.1 SUSE-SU-2026:1417-1
SLES 12 SP5 python3 +1 3.4.10-25.180.1 SUSE-SU-2026:1385-1
SLES 12 SP5 python36 +1 3.6.15-108.1 SUSE-SU-2026:1345-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 3 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES 3 python313 +1 3.13.13-150700.4.45.1 SUSE-SU-2026:1354-1
SLES for SAP 16.0 python313 +2 3.13.13-160000.1.1 SUSE-SU-2026:21178-1
SLES for SAP 15 SP6 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES for SAP 15 SP6 python312 +1 3.12.13-150600.3.53.1 SUSE-SU-2026:4534-1, SUSE-SU-2026:1292-1
SLES for SAP 15 SP5 python311 +2 3.11.15-150400.9.85.1 SUSE-SU-2026:1530-1
SLES for SAP 15 SP5 python39 +1 3.9.25-150300.4.99.1 SUSE-SU-2026:1296-1
SLES for SAP 15 SP4 python310 +1 3.10.20-150400.4.107.1 SUSE-SU-2026:1376-1
SLES for SAP 15 SP4 python311 +2 3.11.15-150400.9.85.1 SUSE-SU-2026:1530-1
SLES 16.0 python313 +2 3.13.13-160000.1.1 SUSE-SU-2026:21178-1
SLE Micro 6.2 python313 +1 3.13.13-160000.1.1 SUSE-SU-2026:21104-1
SLE Micro 6.1 python311 +1 3.11.15-slfo.1.1_3.1 SUSE-SU-2026:23743-1, SUSE-SU-2026:21254-1
SLE HPC 15 SP5 python311 +2 3.11.15-150400.9.85.1 SUSE-SU-2026:1530-1
SLE HPC 15 SP4 python310 +1 3.10.20-150400.4.107.1 SUSE-SU-2026:1376-1
SLE HPC 15 SP4 python311 +2 3.11.15-150400.9.85.1 SUSE-SU-2026:1530-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python310 3.10.20-3.1 openSUSE-SU-2026:10477-1
openSUSE Tumbleweed python311 3.11.15-4.1 openSUSE-SU-2026:10478-1
openSUSE Tumbleweed python312 3.12.13-4.1 openSUSE-SU-2026:10479-1
openSUSE Tumbleweed python313 3.13.12-3.1 openSUSE-SU-2026:10480-1
openSUSE Tumbleweed python314 3.14.3-4.1 openSUSE-SU-2026:10481-1
openSUSE Tumbleweed python315 3.15.0~a7-3.1 openSUSE-SU-2026:10469-1
openSUSE Leap 16.0 python313 +4 3.13.13-160000.1.1 openSUSE-SU-2026:20517-1
openSUSE Leap 15.6 python +2 2.7.18-150000.111.1 SUSE-SU-2026:1206-1
openSUSE Leap 15.6 python310 +2 3.10.20-150400.4.107.1 SUSE-SU-2026:1376-1
openSUSE Leap 15.6 python311 +2 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
openSUSE Leap 15.6 python312 +2 3.12.13-150600.3.53.1 SUSE-SU-2026:1292-1
openSUSE Leap 15.6 python39 +2 3.9.25-150300.4.99.1 SUSE-SU-2026:1296-1
ReleasePackageFixed inAdvisory
Alpine v3.23 python3 3.12.14-r0 —
Alpine v3.22 python3 3.12.14-r0 —
Alpine v3.21 python3 3.12.14-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3 +7 3.9.25-1.amzn2023.0.4 ALAS2023-2026-1583
Amazon Linux 2023 python3.11 +6 3.11.14-1.amzn2023.0.6 ALAS2023-2026-1558
Amazon Linux 2023 python3.12 +6 3.12.12-2.amzn2023.0.5 ALAS2023-2026-1557
Amazon Linux 2023 python3.13 +8 3.13.12-1.amzn2023.0.2 ALAS2023-2026-1555
Amazon Linux 2023 python3.14 +13 3.14.2-2.amzn2023.0.4 ALAS2023-2026-1556
Amazon Linux 2 python +6 2.7.18-1.amzn2.0.18 ALAS2-2026-3227
Amazon Linux 2 python3 +6 3.7.16-1.amzn2.0.25 ALAS2-2026-3228

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-py No fix yet —
Azure Linux 3 python3 3.12.9-10 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3 +7 3.12.12-3.0.1.el10_1.2 ELSA-2026-19064, ELSA-2026-6256
Oracle Linux 10 python3.14 +13 3.14.4-2.el10_2 ELSA-2026-19019
Oracle Linux 9 python3 +7 3.9.25-3.0.1.el9_7.2 ELSA-2026-19216, ELSA-2026-6766
Oracle Linux 9 python3.11 +6 3.11.13-5.2.0.1.el9_7 ELSA-2026-19175, ELSA-2026-6286
Oracle Linux 9 python3.12 +6 3.12.12-4.0.1.el9_7.2 ELSA-2026-19177, ELSA-2026-6285
Oracle Linux 9 python3.14 +13 3.14.4-2.el9_8 ELSA-2026-19176
Oracle Linux 8 python3-idle +6 3.6.8-75.0.1.el8_10 ELSA-2026-6473
Oracle Linux 8 python3.11 +7 3.11.13-6.0.1.el8_10 ELSA-2026-6281
Oracle Linux 8 python3.12 +7 3.12.12-4.el8_10 ELSA-2026-6283
Oracle Linux 7 python +6 2.7.5-94.0.7.el7_9 ELSA-2026-9614
Oracle Linux 7 python3 +6 3.6.8-21.0.11.el7_9 ELSA-2026-9745

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling python-3.10 3.10.20-r1 —
Wolfi rolling python-3.11 3.11.15-r1 —
Wolfi rolling python-3.12 3.12.13-r1 —
Wolfi rolling python-3.13 3.13.12-r5 —
Wolfi rolling python-3.14 3.14.3-r5 —

Advisories 50

References