# CVE-2017-17522: Python 3.5 and 2 others: Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified…

CVE-2017-17522 is fixed in Python 3.6 on 1 platform by Python 3.6 3.6.4 (version 3.6.4), released December 18, 2017. 2 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2017-17522
- Priority: High
- CVSS: 8.8
- EPSS: 0.0360
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 14, 2017
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2017-17522

## Description

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Python 3.6 | 3.6.4 | [Python 3.6 3.6.4](https://patchblox.com/security/data/fix/windows-app/python.python.3.6-3.6.4.md) | Dec 18, 2017 |

## No fix yet

| Platform | Product | Status |
|---|---|---|
| Windows apps | Python 2 | no-fix |
| Windows apps | Python 3.5 | no-fix |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo