Critical Security Vulnerability in python3.14: Command Injection and XSS Risks
Summary
RLSA-2026:28247: Important: python3.14 security, bug fix, and enhancement update. Affects python3.14 versions < 0:3.14.5-1.el9_8. Fixed in 0:3.14.5-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various programming paradigms and provides extensive libraries and frameworks for web development, data analysis, artificial intelligence, and more. However, the recent vulnerabilities in version 3.14 expose users to significant security risks, including arbitrary code execution and cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerabilities identified in python3.14 include a command injection flaw in the webbrowser.open() API (CVE-2026-4786) that allows attackers to execute arbitrary code, and a cross-site scripting (XSS) vulnerability in the http.cookies module (CVE-2026-6019). These vulnerabilities can lead to unauthorized access and manipulation of user data, potentially compromising the integrity and security of applications using this version of Python.
How To Fix
Minimum fixed version
0:3.14.5-1.el9_8
This is the first release that contains the fix.
sudo dnf update python3.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the affected functionalities in the webbrowser and http.cookies modules until the update is applied. Additionally, validate and sanitize all user inputs to mitigate the risk of XSS attacks.
Conclusion
The vulnerabilities in python3.14 present serious security risks that can lead to arbitrary code execution and XSS attacks. It is crucial for users to update to the patched version 3.14.5-1.el9_8 to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for python3.14 →
FAQ
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities can lead to unauthorized code execution and data manipulation, posing significant risks to application security and user data integrity.
Yes, Vulert provides a solution that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, implement input validation and sanitization as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14.
