Critical Security Update for Python 3.11: Command Injection and Code Execution Vulnerabilities
Summary
ALSA-2026:19175: Important: python3.11 security update. Affects python3.11 versions < 3.11.13-9.el9_8. Fixed in 3.11.13-9.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms, including procedural, object-oriented, and functional programming. Python is equipped with a rich standard library and is commonly used for web development, data analysis, artificial intelligence, and more. However, recent vulnerabilities have been identified that could allow attackers to exploit the language's features, leading to severe security risks.
Vulnerability Detail
The vulnerabilities in Python 3.11 stem from command-line option injection and use-after-free issues in its decompression modules. Specifically, crafted URLs can lead to command injection in the webbrowser.open() function, allowing arbitrary code execution or information disclosure. These vulnerabilities (CVE-2026-4519, CVE-2026-4786, CVE-2026-6100) pose significant risks, as they can be exploited to execute malicious code or leak sensitive information.
How To Fix
Minimum fixed version
3.11.13-9.el9_8
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the webbrowser.open() function with untrusted URLs until the update is applied. This can help mitigate the risk of command injection until the vulnerability is fully addressed.
Conclusion
The vulnerabilities in Python 3.11 present serious security risks that can lead to arbitrary code execution and information disclosure. It is crucial for users to update to the latest patched version to safeguard their applications. Utilizing tools like Vulert can also help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python3.11 →
FAQ
The main vulnerabilities include command-line option injection and use-after-free issues that can lead to arbitrary code execution and information disclosure.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, refrain from using the vulnerable functions, such as webbrowser.open() with untrusted URLs, to minimize risk.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, including CVE-2026-4519, CVE-2026-4786, and CVE-2026-6100.
Yes, you can use Vulert's playground to monitor and alert for open-source vulnerabilities in your software projects without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
