Critical Command-Line Option Injection Vulnerability in Python 3.12
Summary
ALSA-2026:6256: Important: python3.12 security update. Affects python-unversioned-command versions < 3.12.12-3.el10_1.2. Fixed in 3.12.12-3.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various programming paradigms and is equipped with extensive libraries and frameworks. The affected version, Python 3.12, is integral for developers and applications relying on Python for scripting, automation, and web development. However, a security flaw has been identified that could allow attackers to exploit command-line options through crafted URLs, posing a significant risk to applications utilizing this version.
Vulnerability Detail
The vulnerability, identified as CVE-2026-4519, arises from a command-line option injection in the webbrowser.open() function. This flaw allows an attacker to manipulate the command-line options by providing specially crafted URLs. If exploited, this could lead to unauthorized command execution or exposure of sensitive information, severely compromising the security of applications that rely on this functionality. The risk is particularly high for web applications that dynamically generate URLs based on user input.
How To Fix
Minimum fixed version
3.12.12-3.el10_1.2
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the webbrowser.open() function with untrusted URLs. Validate and sanitize any user input that may be used to construct URLs before passing them to this function.
Conclusion
The command-line option injection vulnerability in Python 3.12 (CVE-2026-4519) poses a significant security risk that can be mitigated by updating to the patched version 3.12.12-3.el10_1.2. Users are encouraged to validate user inputs and utilize the Vulert platform to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python-unversioned-command →
FAQ
CVE-2026-4519 is a security vulnerability in Python 3.12 that allows command-line option injection through crafted URLs in the webbrowser.open() function.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
The risks include unauthorized command execution and potential exposure of sensitive information, which can compromise the security of applications using the affected Python version.
You can update your Python packages using the command 'sudo dnf update <package_name>' for each affected package, ensuring you install the patched version 3.12.12-3.el10_1.2.
Yes, as a workaround, avoid using the webbrowser.open() function with untrusted URLs and validate any user input that may be used to construct URLs.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.