Skip to content

gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check#148170

Merged
StanFromIreland merged 5 commits intopython:mainfrom
StanFromIreland:webbrowser-fix
Apr 13, 2026
Merged

gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check#148170
StanFromIreland merged 5 commits intopython:mainfrom
StanFromIreland:webbrowser-fix

Conversation

@StanFromIreland
Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland commented Apr 6, 2026 •
edited by bedevere-app Bot
Loading

@bedevere-app bedevere-app Bot mentioned this pull request Apr 6, 2026
Open
@StanFromIreland StanFromIreland requested review from ambv and gpshead April 6, 2026 15:14
gpshead
gpshead reviewed Apr 6, 2026
View reviewed changes
Comment thread Lib/test/test_webbrowser.py
Comment thread Lib/webbrowser.py Outdated
@StanFromIreland StanFromIreland requested a review from gpshead April 6, 2026 17:34
@StanFromIreland StanFromIreland enabled auto-merge (squash) April 13, 2026 18:34
@StanFromIreland
Copy link
Copy Markdown
Member Author

StanFromIreland commented Apr 13, 2026

Thanks for the reviews!

@StanFromIreland StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 13, 2026
@StanFromIreland StanFromIreland merged commit d22922c into python:main Apr 13, 2026
61 checks passed
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148169: Fix webbrowser %action substitution bypass of dash…
f529b94 
…-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148169: Fix webbrowser %action substitution bypass of dash…
5b5617a 
…-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <[email protected]>
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 13, 2026

Sorry, @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d22922c8a7958353689dc4763dd72da2dea03fff 3.12

@StanFromIreland StanFromIreland removed the needs backport to 3.14 bugs and security fixes label Apr 13, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented Apr 13, 2026

GH-148516 is a backport of this pull request to the 3.14 branch.

StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.12] pythongh-148169: Fix webbrowser %action substitution bypass …
a59e9cb 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <[email protected]>
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented Apr 13, 2026

GH-148519 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.12] pythongh-148169: Fix webbrowser %action substitution bypass …
1016d82 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <[email protected]>
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.11] pythongh-148169: Fix webbrowser %action substitution bypass …
d57576d 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <[email protected]>
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented Apr 13, 2026

GH-148520 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.10] pythongh-148169: Fix webbrowser %action substitution bypass …
881ff02 
…of dash-prefix check (pythonGH-148170)

(cherry picked from commit d22922c)

Co-authored-by: Stan Ulbrych <[email protected]>
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented Apr 13, 2026

GH-148521 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Apr 13, 2026
pablogsal pushed a commit that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.11] gh-148169: Fix webbrowser %action substitution bypass of das…
f465482 
…h-prefix check (GH-148170) (#148520)

(cherry picked from commit d22922c)
pablogsal pushed a commit that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.10] gh-148169: Fix webbrowser %action substitution bypass of das…
c5767a7 
…h-prefix check (GH-148170) (#148521)

(cherry picked from commit d22922c)
This was referenced Apr 20, 2026
Closed
Closed
Closed
Closed
octo-sts-6 Bot pushed a commit to wolfi-dev/os that referenced this pull request Apr 23, 2026
@brianmcarey
python-3.14: cherry-pick fix for critical CVE-2026-6100 (#72445)
2ba7218 
- **CVE-2026-6100** (Critical, CVSS 9.1) — Use-after-free in `lzma.LZMADecompressor`,
    `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a decompressor instance is re-used
    after MemoryError. Cherry-pick of commit `6a5f79c8` from the 3.14 branch.
    - GHSA: GHSA-pg25-7cx5-cvcm
    - Upstream: python/cpython#148480

- **CVE-2026-1502** (Medium) — CR/LF bytes not rejected in HTTP client proxy tunnel
    headers. Cherry-pick of commit `b1cf9016` from the 3.14 branch.
    - GHSA: GHSA-hjxq-7w9q-2jw6
    - Upstream: python/cpython#148342

- **CVE-2026-4786** (High) — Incomplete mitigation of CVE-2026-4519; `%action`
    substitution bypass of dash-prefix check in `webbrowser`. Cherry-pick of commit
    `d22922c8` from main (3.14 backport PR #148516 is open and mergeable; identical
    file changes verified).
    - GHSA: GHSA-cccx-m78h-m3xw
    - Upstream: python/cpython#148170

Signed-off-by: Brian Carey <[email protected]>

Export:  edefd2a320a9e3d0ed5d7eb99a5b6f5c35bcb7fc
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
@StanFromIreland @ljfp
pythongh-148169: Fix webbrowser %action substitution bypass of dash…
8143636 
…-prefix check (python#148170)
This was referenced Apr 27, 2026
Closed
Closed
Closed
Closed
hugovk pushed a commit that referenced this pull request Apr 29, 2026
@miss-islington @StanFromIreland
[3.14] gh-148169: Fix webbrowser %action substitution bypass of das…
28b4ad3 
…h-prefix check (GH-148170) (#148516)

Co-authored-by: Stan Ulbrych <[email protected]>
hugovk pushed a commit that referenced this pull request Apr 29, 2026
@miss-islington @StanFromIreland
[3.13] gh-148169: Fix webbrowser %action substitution bypass of das…
d6d6849 
…h-prefix check (GH-148170) (#148517)

Co-authored-by: Stan Ulbrych <[email protected]>
This was referenced May 4, 2026
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

@sethmlarson sethmlarson sethmlarson approved these changes

@ambv ambv Awaiting requested review from ambv

Assignees

@StanFromIreland StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@StanFromIreland @gpshead @sethmlarson