Critical Security Flaw in Python3 Packages: Command-Line Option Injection Vulnerability
Summary
ALSA-2026:6473: Important: python3 security update. Affects platform-python versions < 3.6.8-75.el8_10.alma.1. Fixed in 3.6.8-75.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and is equipped with extensive libraries and frameworks. The affected packages, including platform-python, platform-python-debug, and python3-libs, are integral to the AlmaLinux ecosystem, providing essential functionalities for developers and system administrators. However, a recent vulnerability has been identified that could potentially compromise the security of applications utilizing these packages.
Vulnerability Detail
The vulnerability stems from a command-line option injection in the webbrowser.open() function, which can be exploited via crafted URLs. This flaw allows attackers to manipulate command-line arguments, potentially leading to unauthorized access or execution of arbitrary commands. The associated CVE identifier for this issue is CVE-2026-4519. If left unaddressed, this vulnerability could have severe implications for systems relying on the affected Python packages, exposing them to security breaches.
How To Fix
Minimum fixed version
3.6.8-75.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update platform-pythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the webbrowser.open() function with untrusted URLs until the packages are updated. This precaution can help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
In summary, a critical security vulnerability has been identified in several Python3 packages within the AlmaLinux ecosystem. It is crucial for users to update their packages to the patched version to mitigate the risk of exploitation. Additionally, users should exercise caution when handling URLs in their applications until the update is applied.
See every vulnerability recorded for platform-python →
FAQ
The vulnerability involves command-line option injection in the webbrowser.open() function, allowing attackers to manipulate command-line arguments.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could lead to unauthorized access or execution of arbitrary commands on affected systems.
Yes, a patched version (3.6.8-75.el8_10.alma.1) is available for the affected packages.
As a temporary measure, avoid using the webbrowser.open() function with untrusted URLs until the packages are updated.
Related vulnerabilities
Recent vulnerabilities recorded for platform-python.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
