← CVE Intelligence

CVE-2026-4786

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() PUBLISHED

Description (CNA)

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Affected (CNA)

Vendor / productVersions
Python Software Foundation / CPythonaffected 0 before 3.10.21; affected 3.11.0 before 3.11.16; affected 3.12.0 before 3.12.14; affected 3.13.0 before 3.13.14; affected 3.14.0a1 before 3.14.5rc1; affected 3.15.0a1 before 3.15.0b1

CWE

CWE-77

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.