CVE-2026-4786: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Other sources
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jythonto a version that resolves this vulnerability.Fixed in 2.7.2+repack1-3Fixed in 2.7.3+repack1-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u2Fixed in 7.3.5+dfsg-2+deb11u5Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2Fixed in 7.3.23+dfsg-1 - Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.18-8+deb11u1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u7Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u2Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1Fixed in 3.9.2-1+deb11u7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4786?
CVE-2026-4786 is classified as a medium severity vulnerability due to the potential for command injection through the webbrowser.open() API.
How do I fix CVE-2026-4786?
To fix CVE-2026-4786, ensure that your version of CPython is updated to the latest release that includes the necessary security patches.
What is the impact of CVE-2026-4786?
The impact of CVE-2026-4786 allows attackers to potentially inject commands into the webbrowser.open() API when using vulnerable versions of CPython.
Who is affected by CVE-2026-4786?
Users and developers using specific versions of CPython that utilize the webbrowser.open() API with URL input are affected by CVE-2026-4786.
What is the relationship between CVE-2026-4786 and CVE-2026-4519?
CVE-2026-4786 is an incomplete mitigation of CVE-2026-4519, indicating that the initial fix did not fully address the command injection vulnerability.