python -- more webbrowser.open() command injection vulnerabilities

2026-04-13 · CVE-2026-4786 · VuXML entry

Seth Larson reports: [CVE-2026-4786] Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() There is a HIGH severity vulnerability affecting CPython. Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See …

Affected versions

• python310 < 3.10.20_4
• python311 < 3.11.15_4
• python312 < 3.12.13_4
• python313 < 3.13.14
• python313t < 3.13.14
• python314 < 3.14.4_2

By system

2 still vulnerable, 6 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.