The webbrowser.open() function in CPython accepts URLs that begin with a hyphen. Certain web browsers interpret such leading dashes as command‑line options, allowing an attacker to influence the browser’s behavior or execute arbitrary commands. This lack of input validation is a classic command‑injection issue that can compromise confidentiality, integrity, or availability of the victim system.

Python software, specifically the CPython interpreter’s standard library webbrowser module, is affected. The vulnerability applies to any CPython installation that has not incorporated the patches referenced in the advisory; version numbers are not explicitly provided, so all pre‑patch releases are potentially vulnerable.

With a CVSS score of 7, the vulnerability is of medium‑to‑high severity, yet an EPSS score of less than 1% indicates a low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted URL to webbrowser.open() – typically in applications that accept user input – making the attack vector local to the user’s code execution environment. The risk level is therefore contingent on the application's exposure to untrusted URLs.