Riskcovery

CVE-2026-4786

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

State
Published
Severity
7.0 High
Published
Apr 13, 2026
Updated
Aug 13, 2026
Reserved
Mar 24, 2026

Read the record on cve.org

Description

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Scores

CVSSScoreVectorSource
4.07.0 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NPSF
3.17.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Lredhat-SADP

Weaknesses

  • CWE-77
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

ProductVersions
CPythonPython Software Foundation
  • before 3.10.21Affected
  • 3.11.0 to before 3.11.16Affected
  • 3.12.0 to before 3.12.14Affected
  • 3.13.0 to before 3.13.14Affected
  • 3.14.0a1 to before 3.14.5rc1Affected
  • 3.15.0a1 to before 3.15.0b1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.