python · ambv · Mar 23, 2026 · Mar 20, 2026
diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
@@ -65,6 +65,11 @@ def test_open(self):
                   options=[],
                   arguments=[URL])

+    def test_reject_dash_prefixes(self):
+        browser = self.browser_class(name=CMD_NAME)
+        with self.assertRaises(ValueError):
+            browser.open(f"--key=val {URL}")
+

 class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):


diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
@@ -164,6 +164,12 @@ def open_new(self, url):
    def open_new_tab(self, url):
        return self.open(url, 2)

+    @staticmethod
+    def _check_url(url):
+        """Ensures that the URL is safe to pass to subprocesses as a parameter"""
+        if url and url.lstrip().startswith("-"):
+            raise ValueError(f"Invalid URL: {url}")
+

 class GenericBrowser(BaseBrowser):
    """Class for all browsers started with a command
@@ -181,6 +187,7 @@ def __init__(self, name):

    def open(self, url, new=0, autoraise=True):
        sys.audit("webbrowser.open", url)
+        self._check_url(url)
        cmdline = [self.name] + [arg.replace("%s", url)
                                 for arg in self.args]
        try:
@@ -201,6 +208,7 @@ def open(self, url, new=0, autoraise=True):
        cmdline = [self.name] + [arg.replace("%s", url)
                                 for arg in self.args]
        sys.audit("webbrowser.open", url)
+        self._check_url(url)
        try:
            if sys.platform[:3] == 'win':
                p = subprocess.Popen(cmdline)
@@ -267,6 +275,7 @@ def _invoke(self, args, remote, autoraise, url=None):

    def open(self, url, new=0, autoraise=True):
        sys.audit("webbrowser.open", url)
+        self._check_url(url)
        if new == 0:
            action = self.remote_action
        elif new == 1:
@@ -358,6 +367,7 @@ class Konqueror(BaseBrowser):

    def open(self, url, new=0, autoraise=True):
        sys.audit("webbrowser.open", url)
+        self._check_url(url)
        # XXX Currently I know no way to prevent KFM from opening a new win.
        if new == 2:
            action = "newTab"
@@ -576,6 +586,7 @@ def register_standard_browsers():
    class WindowsDefault(BaseBrowser):
        def open(self, url, new=0, autoraise=True):
            sys.audit("webbrowser.open", url)
+            self._check_url(url)
            try:
                os.startfile(url)
            except OSError:
@@ -596,6 +607,7 @@ def __init__(self, name='default'):

        def open(self, url, new=0, autoraise=True):
            sys.audit("webbrowser.open", url)
+            self._check_url(url)
            url = url.replace('"', '%22')
            if self.name == 'default':
                script = f'open location "{url}"'  # opens in default browser
@@ -627,6 +639,7 @@ def open(self, url, new=0, autoraise=True):
    class IOSBrowser(BaseBrowser):
        def open(self, url, new=0, autoraise=True):
            sys.audit("webbrowser.open", url)
+            self._check_url(url)
            # If ctypes isn't available, we can't open a browser
            if objc is None:
                return False

diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
@@ -0,0 +1 @@
+Reject leading dashes in URLs passed to :func:`webbrowser.open`
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Reject leading dashes in URLs passed to :func:`webbrowser.open`