https://seclists.org/oss-sec/2026/q2/123: [oss-security][CVE-2026-4786] CPython: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Published Apr 13, 2026
·Updated
Affected Software
1 affected component
Python CPython
Frequently Asked Questions
1
What is the severity of CVE-2026-4786?
CVE-2026-4786 has been classified as a HIGH severity vulnerability affecting CPython.
2
What does CVE-2026-4786 entail?
CVE-2026-4786 is a command injection vulnerability resulting from incomplete mitigation of CVE-2026-4519 in the webbrowser.open() function.
3
How do I fix CVE-2026-4786?
To fix CVE-2026-4786, update to the latest version of CPython where the vulnerability has been addressed.
4
Who is affected by CVE-2026-4786?
CVE-2026-4786 affects all users of CPython who utilize the webbrowser.open() method without the latest security fixes.
5
What should I do if I can't update immediately to mitigate CVE-2026-4786?
If an immediate update isn't possible, avoid using the webbrowser.open() method until the vulnerability can be patched.