CVE-2026-4786
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
| CWE | CWE-77 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Apr 13, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new high vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.13.14 3.14.0a1 < 3.14.5rc1 3.15.0a1 < 3.15.0b1
References
github.com: https://github.com/python/cpython/pull/148170 github.com: https://github.com/python/cpython/issues/148169 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/ github.com: https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca github.com: https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff github.com: https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769 github.com: https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53 github.com: https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-4786 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2458049 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4786.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22144 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19589 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:35838 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13812 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16699 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10711 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19064 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19019 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28581 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11077 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11062 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10950 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19590 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17619 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19549 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26187 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19571 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19570 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13692 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21682 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14653 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17525 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19576 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14652 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14656 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10949 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10774 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10745 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19216 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19175 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19177 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19176 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28247 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25096 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30078 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30089 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30088 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30087 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10140 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10141 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8822 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8824 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10117 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9228 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11768 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21275
Credits
🔍 an7y Seth Larson Stan Ulbrych