PT-2026-32545 · Rocky Linux · Rocky Linux

An7Y + 2 · Published 2026-04-13 · Updated 2026-06-12 · CVE-2026-4786

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An incomplete mitigation allows for a bypass when a URL contains the string "%action". For certain browser types, this can lead to command injection into the underlying shell via the webbrowser.open() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

ALSA-2026:10711

ALSA-2026:10745

ALSA-2026:10774

ALSA-2026:10949

ALSA-2026:10950

ALSA-2026:11062

ALSA-2026:11077

ALSA-2026:19019

ALSA-2026:19064

ALSA-2026:19175

ALSA-2026:19176

ALSA-2026:19177

ALSA-2026:19216

BIT-LIBPYTHON-2026-4786

BIT-PYTHON-2026-4786

BIT-PYTHON-MIN-2026-4786

CVE-2026-4786

OESA-2026-2115

OESA-2026-2116

OESA-2026-2117

OPENSUSE-SU-2026:10647-1

OPENSUSE-SU-2026:10648-1

OPENSUSE-SU-2026:10667-1

PSF-2026-17

RHSA-2026:10117

RHSA-2026:10711

RHSA-2026:10745

RHSA-2026:10774

RHSA-2026:10949

RHSA-2026:10950

RHSA-2026:11062

RHSA-2026:11077

RHSA-2026:13692

RHSA-2026:14652

RHSA-2026:14653

RHSA-2026:14656

RHSA-2026:16699

RHSA-2026:17525

RHSA-2026:17619

RHSA-2026:19064

RHSA-2026:19177

RHSA-2026:19549

RHSA-2026:19570

RHSA-2026:19571

RHSA-2026:19576

RHSA-2026:19589

RHSA-2026:19590

RHSA-2026:21682

RHSA-2026:22144

RHSA-2026:8822

RHSA-2026:8824

RHSA-2026:9228

SUSE-SU-2026:2387-1

Affected Products

Rocky Linux

References · 138

• https://github.com/python/cpython/pull/148170 · Patch
• https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff · Patch
• https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca · Patch
• https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769 · Patch
• https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53 · Patch
• https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4 · Patch
• https://linux.oracle.com/errata/ELSA-2026-10949.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19019 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19177 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:19216 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:19176 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:11077 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2026-17 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10667-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:10950 · Vendor Advisory