CVE-2026-4786 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Attackers can inject shell commands via webbrowser.open() when URLs contain %action, bypassing previous mitigations in the Python standard library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-4786?
CVE-2026-4786 is a high-severity command injection vulnerability in CPython, published on 13 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
Which versions are affected by CVE-2026-4786?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
python Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
python-min Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
Linux distribution packages (23)
python Red Hat:rhel_els:6 | All versions | 0:2.6.6-70.el6_10.4 |
python-debuginfo Red Hat:rhel_els:6 | All versions | 0:2.6.6-70.el6_10.4 |
python-devel Red Hat:rhel_els:6 | All versions | 0:2.6.6-70.el6_10.4 |
python-libs Red Hat:rhel_els:6 | All versions | 0:2.6.6-70.el6_10.4 |
python-test Red Hat:rhel_els:6 | All versions | 0:2.6.6-70.el6_10.4 |
python-tools Red Hat:rhel_els:6 | All versions | 0:2.6.6-70.el6_10.4 |
tkinter Red Hat:rhel_els:6 | All versions | 0:2.6.6-70.el6_10.4 |
python Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
python-debug Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
python-debuginfo Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
python-devel Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
python-libs Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
python-test Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
python-tools Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
python3 Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
python3-debug Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
python3-debuginfo Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
python3-devel Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
python3-idle Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
python3-libs Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
python3-test Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
python3-tkinter Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.6 |
tkinter Red Hat:rhel_els:7 | All versions | 0:2.7.5-94.el7_9.5 |
How do I fix CVE-2026-4786?
Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.14.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-4786 being exploited?
There is no known exploitation of CVE-2026-4786 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-4786, AZL-83054, BELL-CVE-2026-4786, BIT-libpython-2026-4786, BIT-python-2026-4786, BIT-python-min-2026-4786 and 18 more.