Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python: Malicious URL Injection in pydoc/subprocess
published 6 months ago
Summary
A security issue in Python's pydoc and subprocess modules can allow an attacker to execute malicious code by injecting CLI options into URLs. This issue affects Python versions that include these modules. To fix this issue, update to the latest version of Python.
What to do
- Update redhat python3 to version 3.6.8-21.0.5.el7_9.tuxcare.els9.
- Update redhat python3-debug to version 3.6.8-21.0.5.el7_9.tuxcare.els9.
- Update redhat python3-devel to version 3.6.8-21.0.5.el7_9.tuxcare.els9.
- Update redhat python3-idle to version 3.6.8-21.0.5.el7_9.tuxcare.els9.
- Update redhat python3-libs to version 3.6.8-21.0.5.el7_9.tuxcare.els9.
- Update redhat python3-test to version 3.6.8-21.0.5.el7_9.tuxcare.els9.
- Update redhat python3-tkinter to version 3.6.8-21.0.5.el7_9.tuxcare.els9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:RHEL:7 | redhat | python3 |
< 3.6.8-21.0.5.el7_9.tuxcare.els9 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els9
|
| TuxCare:RHEL:7 | redhat | python3-debug |
< 3.6.8-21.0.5.el7_9.tuxcare.els9 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els9
|
| TuxCare:RHEL:7 | redhat | python3-devel |
< 3.6.8-21.0.5.el7_9.tuxcare.els9 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els9
|
| TuxCare:RHEL:7 | redhat | python3-idle |
< 3.6.8-21.0.5.el7_9.tuxcare.els9 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els9
|
| TuxCare:RHEL:7 | redhat | python3-libs |
< 3.6.8-21.0.5.el7_9.tuxcare.els9 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els9
|
| TuxCare:RHEL:7 | redhat | python3-test |
< 3.6.8-21.0.5.el7_9.tuxcare.els9 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els9
|
| TuxCare:RHEL:7 | redhat | python3-tkinter |
< 3.6.8-21.0.5.el7_9.tuxcare.els9 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els9
|
Original advisory text
python3: Fix of CVE-2026-4519
- CVE-2026-4519: reject leading dashes in webbrowser URLs to prevent CLI option injection in pydoc/subprocess
References
Timeline
Published5 May 2026
Updated3 Jun 2026
First seen3 Jun 2026
Sources
CLSA-2026-1778002076 · OSV
Track software like this
Free during beta