What’s Vulnerable › Vulnerabilities

CVE-2026-4786: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-13 · updated 2026-10-26
• Weakness: CWE-77

Description

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Affected products

• Python: before 3.10.21; from 3.11.0 before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.14; from 3.14.0a1 before 3.14.5rc1; from 3.15.0a1 before 3.15.0b1 — fixed in 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.5rc1, 3.15.0b1

How to fix

Upgrade to a fixed version: Python 3.10.21, 3.11.16, 3.12.14, 3.13.14. Check the vendor advisory for mitigations.

References

• https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53
• https://github.com/python/cpython/commit/a4d3edf3a6ecfde504d02126410d2a65a859b744
• https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca
• https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff
• https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4
• https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769
• https://github.com/python/cpython/issues/148169
• https://github.com/python/cpython/pull/148170
• https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/
• https://access.redhat.com/errata/RHSA-2026:10117
• https://access.redhat.com/errata/RHSA-2026:10140
• https://access.redhat.com/errata/RHSA-2026:10141

Get alerted when CVE-2026-4786 or the next vulnerability affects your stack