Python CPython "webbrowser.open" "%action" URL injection (CVE-2026-4786)
CVE-2026-4786 Published on April 13, 2026

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-4786 is exploitable with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
LOW

Weakness Types

What is a Command Injection Vulnerability?

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CVE-2026-4786 has been classified to as a Command Injection vulnerability or weakness.

What is an Argument Injection Vulnerability?

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

CVE-2026-4786 has been classified to as an Argument Injection vulnerability or weakness.


Products Associated with CVE-2026-4786

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-4786 are published in these products:

Python
 
Red Hat Rhel Els
 
Red Hat Rhosemc
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel E4s
 
Red Hat Rhel Tus
 
Red Hat Rhel Eus
 
Red Hat Ai Inference Server
 
Red Hat Enterprise Linux Ai
 
Red Hat Hummingbird
 
Red Hat Rhui
 
Canonical Ubuntu Linux
 

Affected Versions

Python Software Foundation CPython: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION: Red Hat Enterprise Linux 7 Extended Lifecycle Support: Red Hat Enterprise Linux 7 Extended Lifecycle Support: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.6 Telecommunications Update Service: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Enterprise Linux AI 3.3: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8:

Exploit Probability

EPSS
0.21%
Percentile
10.96%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.