Critical Security Flaws in Python 3.9: Command Injection and Code Execution Vulnerabilities
Summary
RLSA-2026:19216: Important: python3.9 security update. Affects python3.9 versions < 0:3.9.25-7.el9_8. Fixed in 0:3.9.25-7.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.9 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features dynamic typing, high-level data types, and extensive libraries, making it a versatile choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this version.
Vulnerability Detail
The vulnerabilities in Python 3.9 stem from command-line option injection and use-after-free issues in decompression modules. Specifically, crafted URLs can lead to command injection in the webbrowser.open() API, allowing arbitrary code execution or information disclosure. The vulnerabilities are tracked under CVE-2026-4519, CVE-2026-4786, and CVE-2026-6100, with a CVSS score of 8.1 indicating a high severity level. These flaws could allow attackers to execute malicious code or access sensitive information, posing significant risks to applications relying on this version of Python.
How To Fix
Minimum fixed version
0:3.9.25-7.el9_8
This is the first release that contains the fix.
sudo dnf update python3.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the webbrowser.open() API with untrusted URLs until the package is updated. Validate and sanitize any URLs before processing them to mitigate the risk of command injection.
Conclusion
The vulnerabilities identified in Python 3.9 pose significant risks to applications using this version. It is crucial to update to the patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor and alert for open-source vulnerabilities in their software.
See every vulnerability recorded for python3.9 →
FAQ
The main vulnerabilities include command-line option injection and arbitrary code execution due to use-after-free issues in decompression modules.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If an immediate update is not possible, avoid using the vulnerable features and validate any URLs processed by your application.
More information can be found on the CVE pages for CVE-2026-4519, CVE-2026-4786, and CVE-2026-6100.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.9.
