Skip to main content

Cpython CVE-2026-4786

| EUVDEUVD-2026-22134 HIGH
Command Injection (CWE-77)
2026-04-13 PSF GHSA-cccx-m78h-m3xw
Command Injection Cpython Python Software Foundation
7.0
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Deliver malicious Python script/app
  2. Delivery
    Victim executes code calling webbrowser.open()
  3. Exploit
    Crafted URL with '%action' pattern bypasses sanitization
  4. Execution
    Shell command constructed with injected metacharacters
  5. Persist
    Arbitrary commands execute with user privileges
  6. Impact
    Data exfiltration or system compromise

Vulnerability Assessment

Weakness
CWE
CWE-77
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target system to have a specific browser type registered as default that processes '%action' URL patterns in a manner vulnerable to shell injection when invoked via CPython's webbrowser.open() API. The attack depends on the victim's browser configuration (AT:P in CVSS vector), as not all browser types exhibit the exploitable behavior. Additionally, user interaction (UI:A) is mandatory - the victim must execute Python code or an application that calls webbrowser.open() with the attacker-controlled malicious URL. Local access (AV:L) is required to deliver the malicious Python code or influence the target application's input.
Impact

Real-world risk is moderate despite the 7.0 CVSS score. The CVSS:4.0 vector shows local attack vector (AV:L), low complexity (AC:L), but requires user interaction (UI:A) and specific attack conditions (AT:P - browser type dependency). EPSS assigns only 0.02% exploitation probability (5th percentile), indicating security researchers assess this as unlikely to be exploited at scale. No KEV listing confirms no active exploitation observed. The attack requires local access and tricking a user into opening a malicious URL via Python's webbrowser API - a narrow attack surface compared to remotely exploitable flaws. However, the incomplete mitigation pattern (bypass of CVE-2026-4519) suggests underlying architectural fragility in command construction logic that may yield future bypasses. Patch availability across three GitHub commits (c5767a7, d22922c, f465482) and official security advisory indicates vendor responsiveness. Priority should align with whether your environment uses CPython's webbrowser module in user-facing applications that process untrusted URLs - high priority for such cases, otherwise deprioritize below remote/unauthenticated threats.
Exploit ScenarioDerived

An attacker crafts a malicious Python script or convinces a user to run a legitimate application that calls webbrowser.open() with a specially crafted URL containing '%action' followed by shell metacharacters (e.g., '; malicious_command'). When the victim executes the script or application on a system with a vulnerable browser configuration, the webbrowser module constructs a shell command to launch the browser, but the '%action' pattern bypasses the CVE-2026-4519 sanitization logic. The injected shell metacharacters execute arbitrary commands with the privileges of the Python process, potentially installing malware, exfiltrating data, or modifying system configurations.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 15, 2026

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted URLs containing '%action' patterns. All CPython versions prior to 3.15.0 are affected, allowing local attackers with user interaction to execute arbitrary commands through underlying shell injection. EPSS probability is low (0.02%, 5th percentile), no active exploitation confirmed (not in CISA KEV), but publicly available patches exist via multiple GitHub commits. The incomplete mitigation highlights the challenge of securing browser-handling code across diverse browser implementations.

RemediationAI

Upgrade to CPython 3.15.0 or later, which includes complete fixes via GitHub commits c5767a72838a8dda9d6dc5d3558075b055c56bca, d22922c8a7958353689dc4763dd72da2dea03fff, and f4654824ae0850ac87227fb270f9057477946769 merged in PR #148170. For environments unable to upgrade immediately, avoid passing user-controlled or untrusted URLs to webbrowser.open() without rigorous input validation. Implement allowlisting for URL schemes (http/https only) and reject URLs containing '%action' patterns or shell metacharacters. Review application code for instances where webbrowser module processes external input. Consult GitHub issue #148169 for technical implementation details and vendor advisory at https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/ for additional mitigation guidance.

Affected VersionsENISA

CPython 0 <3.15.0

Affected Packages

euvd cpython fix: 3.15.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects the Python Software Foundation's CPython interpreter (cpe:2.3:a:python_software_foundation:cpython), specifically the webbrowser module's open() API which provides cross-platform browser launching functionality. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection class vulnerability. The webbrowser module constructs shell commands to invoke external browsers, and the previous CVE-2026-4519 fix attempted to sanitize URLs but failed to account for '%action' URL patterns. When these patterns are present, certain browser types process the URL in ways that allow shell metacharacters to escape sanitization, ultimately reaching the underlying shell interpreter (via subprocess calls or similar mechanisms). The browser-type dependency explains the 'AT:P' (Attack Requirements: Present) rating in the CVSS vector, as exploitation success depends on the specific browser registered as the system default.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 7.0 HIGH
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 4.0 MEDIUM
Red Hat 7.1 HIGH

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

3
CVSS changed
Apr 13, 2026 - 22:52 NVD
7.0 (HIGH)
Patch released
Apr 13, 2026 - 22:00 nvd
Patch available
CVE Published
Apr 13, 2026 - 21:52 nvd
HIGH 7.0

DescriptionCVE.org

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Executive ViewAI

Why It Matters

CPython versions prior to 3.15.0 contain a command injection vulnerability in the webbrowser.open() API that bypasses a previous security fix, allowing local attackers to execute arbitrary commands through malicious URLs. Organizations running affected CPython versions must upgrade immediately, as this vulnerability could be exploited by users inadvertently opening specially crafted links, potentially leading to unauthorized code execution and lateral movement within systems.

Business Impact: High
Compensating Controls

Apply vendor patch. If upgrade to CPython 3.15.0 is not immediately feasible: (1) restrict webbrowser.open() function calls to trusted, statically-defined URLs only; (2) implement application-level URL validation to reject URLs containing '%action' or other shell metacharacters; (3) run affected applications with minimum required privileges; (4) disable webbrowser module functionality where not essential to business operations.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

CVE-2026-19672 MEDIUM
6.3 Aug 19

CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
CVE-2026-7210 MEDIUM
6.3 May 11

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/148170 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4786 ADVISORY https://ubuntu.com/security/notices/USN-8509-1 ADVISORY https://vuldb.com/vuln/357256 REF https://access.redhat.com/errata/RHSA-2026:10117 REF https://access.redhat.com/errata/RHSA-2026:10140 REF https://access.redhat.com/errata/RHSA-2026:10141 REF https://access.redhat.com/errata/RHSA-2026:10711 REF https://access.redhat.com/errata/RHSA-2026:10745 REF https://access.redhat.com/errata/RHSA-2026:10774 REF https://access.redhat.com/errata/RHSA-2026:10949 REF https://access.redhat.com/errata/RHSA-2026:10950 REF https://access.redhat.com/errata/RHSA-2026:11062 REF https://access.redhat.com/errata/RHSA-2026:11077 REF https://access.redhat.com/errata/RHSA-2026:11768 REF https://access.redhat.com/errata/RHSA-2026:13692 REF https://access.redhat.com/errata/RHSA-2026:13812 REF https://access.redhat.com/errata/RHSA-2026:14652 REF https://access.redhat.com/errata/RHSA-2026:14653 REF https://access.redhat.com/errata/RHSA-2026:14656 REF https://access.redhat.com/errata/RHSA-2026:16699 REF https://access.redhat.com/errata/RHSA-2026:17525 REF https://access.redhat.com/errata/RHSA-2026:17619 REF https://access.redhat.com/errata/RHSA-2026:19019 REF https://access.redhat.com/errata/RHSA-2026:19064 REF https://access.redhat.com/errata/RHSA-2026:19175 REF https://access.redhat.com/errata/RHSA-2026:19176 REF https://access.redhat.com/errata/RHSA-2026:19177 REF https://access.redhat.com/errata/RHSA-2026:19216 REF https://access.redhat.com/errata/RHSA-2026:19549 REF https://access.redhat.com/errata/RHSA-2026:19570 REF https://access.redhat.com/errata/RHSA-2026:19571 REF https://access.redhat.com/errata/RHSA-2026:19576 REF https://access.redhat.com/errata/RHSA-2026:19589 REF https://access.redhat.com/errata/RHSA-2026:19590 REF https://access.redhat.com/errata/RHSA-2026:21275 REF https://access.redhat.com/errata/RHSA-2026:21682 REF https://access.redhat.com/errata/RHSA-2026:22144 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:26187 REF https://access.redhat.com/errata/RHSA-2026:28247 REF https://access.redhat.com/errata/RHSA-2026:28581 REF https://access.redhat.com/errata/RHSA-2026:30078 REF https://access.redhat.com/errata/RHSA-2026:30087 REF https://access.redhat.com/errata/RHSA-2026:30088 REF https://access.redhat.com/errata/RHSA-2026:30089 REF https://access.redhat.com/errata/RHSA-2026:35838 REF https://access.redhat.com/errata/RHSA-2026:8822 REF https://access.redhat.com/errata/RHSA-2026:8824 REF https://access.redhat.com/errata/RHSA-2026:9228 REF https://access.redhat.com/security/cve/CVE-2026-4786 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458049 REF https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53 REF https://github.com/python/cpython/commit/a4d3edf3a6ecfde504d02126410d2a65a859b744 REF https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca REF https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff REF https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4 REF https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769 REF https://github.com/python/cpython/issues/148169 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4786.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy