webbrowser: %action substitution can bypass the dash-prefix check #148169

Activity

1. StanFromIreland

   self-assigned this

   on Apr 6, 2026
2. StanFromIreland

   added

   type-securityA security issueA security issue

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Apr 6, 2026
3. StanFromIreland

   added a commit that references this issue on Apr 13, 2026

   gh-148169: Fix webbrowser `%action` substitution bypass of dash-prefi…

   ...

   d22922c
4. miss-islington

   added 2 commits that reference this issue on Apr 13, 2026

   pythongh-148169: Fix webbrowser `%action` substitution bypass of dash…

   ...

   f529b94

   pythongh-148169: Fix webbrowser `%action` substitution bypass of dash…

   ...

   5b5617a
5. StanFromIreland

   added 4 commits that reference this issue on Apr 13, 2026

   [3.12] pythongh-148169: Fix webbrowser `%action` substitution bypass …

   ...

   a59e9cb

   [3.12] pythongh-148169: Fix webbrowser `%action` substitution bypass …

   ...

   1016d82

   [3.11] pythongh-148169: Fix webbrowser `%action` substitution bypass …

   ...

   d57576d

   [3.10] pythongh-148169: Fix webbrowser `%action` substitution bypass …

   ...

   881ff02
6. StanFromIreland

   added

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   on Apr 13, 2026
7. 8 remaining items

   Load more
8. hugovk

   added a commit that references this issue on Apr 29, 2026

   [3.13] gh-148169: Fix webbrowser `%action` substitution bypass of das…

   ...

   d6d6849
9. bmwiedemann

   added 2 commits that reference this issue on Apr 29, 2026

   Update python315 to version 3.15.0~a8 / rev 13 via SR 1349863

   ...

   e0f2724

   Update python313 to version 3.13.13 / rev 41 via SR 1349656

   ...

   efb1aca
10. StanFromIreland

    removed

    3.13only security fixesonly security fixes

    3.14bugs and security fixesbugs and security fixes

    on May 3, 2026
11. bmwiedemann

    added a commit that references this issue on Jun 22, 2026

    Update python312 to version 3.12.13 / rev 49 via SR 1360565

    ...

    0e1eb21
12. Yhg1s

    added a commit that references this issue on Aug 4, 2026

    [3.12] gh-148169: Fix webbrowser `%action` substitution bypass of das…

    ...

    a4d3edf
13. StanFromIreland

    closed this as completedon Aug 4, 2026
14. arnout

    added a commit that references this issue on Aug 14, 2026

    package/python3: security bump to v3.12.14

    ...

    80251a0
15. mcepl

    added 3 commits that reference this issue on Sep 18, 2026

    (CVE-2026-4786) Fix webbrowser `%action` substitution bypass of dash-…

    ...

    2927892

    (CVE-2026-4786) Fix webbrowser `%action` substitution bypass of dash-…

    ...

    eadc282

    (CVE-2026-4786) Fix webbrowser `%action` substitution bypass of dash-…

    ...

    55ce0f3
16. mcepl

    added 3 commits that reference this issue on Oct 1, 2026

    (CVE-2026-4786) Fix webbrowser `%action` substitution bypass of dash-…

    ...

    9e42d0b

    (CVE-2026-4786) Fix webbrowser `%action` substitution bypass of dash-…

    ...

    f11f558

    (CVE-2026-4786) Fix webbrowser `%action` substitution bypass of dash-…

    ...

    228a60c