Critical Command-Line Option Injection Vulnerability in Python 3.9 Packages
Summary
ALSA-2026:6766: Important: python3.9 security update. Affects python-unversioned-command versions < 3.9.25-3.el9_7.2. Fixed in 3.9.25-3.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and is equipped with extensive libraries and frameworks. The affected packages in this advisory include python-unversioned-command, python3, python3-debug, python3-devel, python3-idle, python3-libs, python3-test, and python3-tkinter, all of which are essential components for Python development and execution in the AlmaLinux 9 ecosystem.
Vulnerability Detail
The vulnerability arises from a command-line option injection in the webbrowser.open() function, which can be exploited via crafted URLs. This flaw allows attackers to manipulate command-line arguments, potentially leading to unauthorized actions or exposure of sensitive information. The issue is tracked under CVE-2026-4519 and poses a significant risk to applications relying on this functionality, as it can be exploited to execute arbitrary commands.
How To Fix
Minimum fixed version
3.9.25-3.el9_7.2
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the webbrowser.open() function with untrusted URLs until the package is updated. It is advisable to validate and sanitize any URLs before passing them to this function to mitigate potential risks.
Conclusion
The command-line option injection vulnerability in Python 3.9 packages poses a significant risk to applications utilizing the affected functions. It is crucial for users to update their packages to the latest patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-unversioned-command →
FAQ
The vulnerability is a command-line option injection that can be exploited through crafted URLs in the webbrowser.open() function.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized command execution, data exposure, or other malicious actions within the affected application.
Yes, a patch is available in version 3.9.25-3.el9_7.2 for all affected Python packages.
If immediate updates are not possible, ensure to validate and sanitize URLs used with the webbrowser.open() function to minimize risk.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
