CVE-2026-4786
Command Injection via Incomplete Mitigation in Python webbrowser.open
Publication date: 2026-04-13
Last updated on: 2026-04-29
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| python | cpython | 3.10 |
| python | cpython | 3.11 |
| python | cpython | 3.12 |
| python | cpython | 3.13 |
| python | cpython | 3.14 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the Python webbrowser module's handling of URLs containing the "%action" substitution, which can bypass dash-prefix safety checks and allow command injection. Detection would involve identifying usage of the webbrowser.open() API with URLs containing "%action" sequences that could expand into dash-prefixed commands.
Since the vulnerability is related to Python code execution rather than network traffic, detection on a network level is limited. On the system, you can audit Python scripts or applications that use the webbrowser module and check for calls to webbrowser.open() with URLs containing "%action".
Suggested commands to detect potential exploitation attempts or vulnerable usage include searching your codebase or running processes for the pattern "%action" in Python scripts or logs:
- grep -r --include='*.py' '%action' /path/to/your/python/code
- ps aux | grep python | grep webbrowser
- Audit logs or monitoring tools for calls to webbrowser.open() with suspicious URL parameters containing "%action".
Can you explain this vulnerability to me?
This vulnerability is related to an incomplete mitigation of a previous issue identified as CVE-2026-4519. Specifically, if a URL contains the string "%action", the mitigation can be bypassed for certain browser types. This allows the "webbrowser.open()" API to have commands injected into the underlying shell, potentially leading to unintended command execution.
How can this vulnerability impact me? :
The vulnerability could allow an attacker to inject commands into the shell via the "webbrowser.open()" API when a specially crafted URL containing "%action" is used. This could lead to unauthorized command execution on the affected system, potentially compromising system integrity or security.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the security patch that fixes the handling of the "%action" substitution in the Python webbrowser module. This patch ensures that the dash-prefix safety check is performed after substituting "%action", preventing bypass and command injection.
Specifically, update your Python environment to a version that includes the fix merged on April 13, 2026, which is backported to Python versions 3.10 through 3.14.
If updating is not immediately possible, audit and restrict usage of the webbrowser.open() API in your code to avoid URLs containing "%action" or any untrusted input that could exploit this substitution.
Additionally, review and apply any relevant security advisories or patches from the Python project related to CVE-2026-4786.