CVE-2026-4786: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Other sources
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.22+dfsg-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.5-1 - Upgrade
Upgrade
debian/jythonto a version that resolves this vulnerability.Fixed in 2.7.3+repack1-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4786?
CVE-2026-4786 is classified as a medium severity vulnerability due to the potential for command injection through the webbrowser.open() API.
How do I fix CVE-2026-4786?
To fix CVE-2026-4786, ensure that your version of CPython is updated to the latest release that includes the necessary security patches.
What is the impact of CVE-2026-4786?
The impact of CVE-2026-4786 allows attackers to potentially inject commands into the webbrowser.open() API when using vulnerable versions of CPython.
Who is affected by CVE-2026-4786?
Users and developers using specific versions of CPython that utilize the webbrowser.open() API with URL input are affected by CVE-2026-4786.
What is the relationship between CVE-2026-4786 and CVE-2026-4519?
CVE-2026-4786 is an incomplete mitigation of CVE-2026-4519, indicating that the initial fix did not fully address the command injection vulnerability.