CVE-2026-4786
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
HIGH
7.1
CVSS Score
Published: April 13, 2026 at 09:52 PM UTC
Updated: October 26, 2026 at 09:10 PM UTC
2 products affected across 2 vendorsPythonEnterprise Linux
Using CPython by Python Software Foundation?
Get instant alerts when new vulnerabilities affect CPython - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit
Description
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 3.10.213.11.0 ≤ v < 3.11.163.12.0 ≤ v < 3.12.143.13.0 ≤ v < 3.13.143.14.0a1 ≤ v < 3.14.5rc13.15.0a1 ≤ v < 3.15.0b13.11.03.12.03.13.03.14.0a13.15.0a1
Affected range stops below 3.10.21, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.11.16, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.12.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.13.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.14.5rc1, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.15.0b1, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 0:2.6.6-70.el6_10.4 (unaffected)
Vendor states this is fixed in 0:2.7.5-94.el7_9.5 (unaffected)
Vendor states this is fixed in 0:3.11.11-2.el9_6.7 (unaffected)
Vendor states this is fixed in 0:3.11.13-5.3.el9_7 (unaffected)
Vendor states this is fixed in 0:3.11.13-7.el8_10 (unaffected)
Vendor states this is fixed in 0:3.11.13-9.el9_8 (unaffected)
Vendor states this is fixed in 0:3.11.2-2.el8_8.10 (unaffected)
Vendor states this is fixed in 0:3.11.2-2.el9_2.12 (unaffected)
Vendor states this is fixed in 0:3.11.7-1.el9_4.13 (unaffected)
Vendor states this is fixed in 0:3.12.1-4.el9_4.13 (unaffected)
Vendor states this is fixed in 0:3.12.12-3.el10_1.3 (unaffected)
Vendor states this is fixed in 0:3.12.12-4.el9_7.3 (unaffected)
Vendor states this is fixed in 0:3.12.13-2.el10_2 (unaffected)
Vendor states this is fixed in 0:3.12.13-2.el8_10 (unaffected)
Vendor states this is fixed in 0:3.12.13-2.el9_8 (unaffected)
Vendor states this is fixed in 0:3.12.9-1.el9_6.8 (unaffected)
Vendor states this is fixed in 0:3.12.9-2.el10_0.9 (unaffected)
Vendor states this is fixed in 0:3.14.4-2.el10_2 (unaffected)
Vendor states this is fixed in 0:3.14.4-2.el9_8 (unaffected)
Vendor states this is fixed in 0:3.14.5-1.el10_2 (unaffected)
Vendor states this is fixed in 0:3.14.5-1.el9_8 (unaffected)
Vendor states this is fixed in 0:3.6.8-21.el7_9.6 (unaffected)
Vendor states this is fixed in 0:3.6.8-39.el8_4.11 (unaffected)
Vendor states this is fixed in 0:3.6.8-47.el8_6.13 (unaffected)
Vendor states this is fixed in 0:3.6.8-51.el8_8.15 (unaffected)
Vendor states this is fixed in 0:3.6.8-76.el8_10 (unaffected)
Vendor states this is fixed in 0:3.9.10-4.el9_0.11 (unaffected)
Vendor states this is fixed in 0:3.9.16-1.el9_2.14 (unaffected)
Vendor states this is fixed in 0:3.9.18-3.el9_4.13 (unaffected)
Vendor states this is fixed in 0:3.9.21-2.el9_6.6 (unaffected)
Vendor states this is fixed in 0:3.9.25-3.el9_7.3 (unaffected)
Vendor states this is fixed in 0:3.9.25-7.el9_8 (unaffected)
Vendor states this is fixed in 8 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://github.com/python/cpython/pull/148170
- https://mail.python.org/archives/list/[email protected]/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/
- https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca
- https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff
- https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769
References (58)
Vendor Advisory
Source: cverecord
https://mail.python.org/archives/list/[email protected]/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/Patch
Source: cverecord
https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bcaPatch
Source: cverecord
https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fffPatch
Source: cverecord
https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769Patch
Source: cverecord
https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53Patch
Source: cverecord
https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4SSVC — Action Prioritization
SSVCNo known exploitNot automatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
7.1HIGHredhat-SADP
- Attack Vector
- NETWORK
- Complexity
- HIGH
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- LOW
Vector?
Quick Info
StatusAWAITING ANALYSIS
CWE
CWE-77CWE-88
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card