PT-2026-32545 · Python+3 · Webbrowser+3

An7Y + 2 · CVE-2026-4786 · Published 2026-04-13 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An incomplete mitigation allows for a bypass when a URL contains the string "%action". For certain browser types, this can lead to command injection into the underlying shell via the webbrowser.open() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Command Injection

Argument Injection

Weakness Enumeration

CWE-77

CWE-88

Related Identifiers

ALSA-2026:10711

ALSA-2026:10745

ALSA-2026:10774

ALSA-2026:10949

ALSA-2026:10950

ALSA-2026:11062

ALSA-2026:11077

ALSA-2026:19019

ALSA-2026:19064

ALSA-2026:19175

ALSA-2026:19176

ALSA-2026:19177

ALSA-2026:19216

ALSA-2026:28247

ALSA-2026:28581

BDU:2026-09777

BIT-LIBPYTHON-2026-4786

BIT-PYTHON-2026-4786

BIT-PYTHON-MIN-2026-4786

CVE-2026-4786

OESA-2026-2115

OESA-2026-2116

OESA-2026-2117

OPENSUSE-SU-2026:10647-1

OPENSUSE-SU-2026:10648-1

OPENSUSE-SU-2026:10667-1

OPENSUSE-SU-2026:11068-1

OPENSUSE-SU-2026:11100-1

OPENSUSE-SU-2026:11181-1

OPENSUSE-SU-2026:21459-1

PSF-2026-17

RHSA-2026:10117

RHSA-2026:10711

RHSA-2026:10745

RHSA-2026:10774

RHSA-2026:10949

RHSA-2026:10950

RHSA-2026:11062

RHSA-2026:11077

RHSA-2026:13692

RHSA-2026:14652

RHSA-2026:14653

RHSA-2026:14656

RHSA-2026:16699

RHSA-2026:17525

RHSA-2026:17619

RHSA-2026:19064

RHSA-2026:19177

RHSA-2026:19549

RHSA-2026:19570

RHSA-2026:19571

RHSA-2026:19576

RHSA-2026:19589

RHSA-2026:19590

RHSA-2026:21682

RHSA-2026:22144

RHSA-2026:26187

RHSA-2026:28247

RHSA-2026:28581

RHSA-2026:35838

RHSA-2026:8822

RHSA-2026:8824

RHSA-2026:9228

SUSE-SU-2026:1715-1

SUSE-SU-2026:1818-1

SUSE-SU-2026:1937-1

SUSE-SU-2026:1947-1

SUSE-SU-2026:2055-1

SUSE-SU-2026:2387-1

SUSE-SU-2026:2464-1

SUSE-SU-2026:2664-1

SUSE-SU-2026:3104-1

SUSE-SU-2026:3132-1

USN-8509-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Webbrowser

References · 255

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4786.json · Exploit
• https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff · Patch
• https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4 · Patch
• https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769 · Patch
• https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca · Patch
• https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53 · Patch
• https://github.com/python/cpython/pull/148170 · Patch
• https://ubuntu.com/security/CVE-2026-6100 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19176 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-19175.html · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-28247.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4786 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11181-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:28247 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4189 · Vendor Advisory