Critical Command-Line Option Injection Vulnerability in Python 3.12
Summary
ALSA-2026:6283: Important: python3.12 security update. Affects python3.12 versions < 3.12.12-4.el8_10. Fixed in 3.12.12-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports various system calls and libraries. It is widely used for web development, data analysis, artificial intelligence, and more. The package includes modules, classes, exceptions, and high-level dynamic data types, making it versatile for developers. However, a recently discovered vulnerability poses a significant risk to its security.
Vulnerability Detail
The vulnerability identified as CVE-2026-4519 involves command-line option injection in the webbrowser.open() function. This issue arises when crafted URLs are passed to the function, allowing attackers to execute arbitrary commands. The implications of this vulnerability can lead to unauthorized access, data leakage, or system compromise, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.12.12-4.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the webbrowser.open() function with untrusted URLs. Validate and sanitize any URLs before passing them to this function to mitigate the risk of command injection.
Conclusion
The command-line option injection vulnerability in Python 3.12 (CVE-2026-4519) poses significant security risks. Users are strongly advised to update to the patched version 3.12.12-4.el8_10 and to implement workarounds until the update can be applied. Monitoring tools like Vulert can assist in identifying such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2026-4519 is a security vulnerability in Python 3.12 that allows command-line option injection through crafted URLs in the webbrowser.open() function.
You can check your Python version by running 'python3.12 --version' in your terminal. If it is below 3.12.12-4.el8_10, it is vulnerable.
The risks include unauthorized command execution, potential data leakage, and system compromise, which can severely impact the security of your applications.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
