This vulnerability (CVE-2026-4786) affects CPython and is related to an incomplete mitigation of CVE-2026-4519. When the URL passed to the webbrowser.open() API contains "%action", it can bypass the previous mitigation for certain browsers, leading to command injection in the underlying shell. The issue is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS 4.0 vector indicates local attack vector, low attack complexity, partial attack type, no privileges required, user interaction required, and high impact on confidentiality and integrity.

Successful exploitation could allow an attacker to inject arbitrary commands into the shell via the webbrowser.open() API when certain URL patterns are used. This could lead to unauthorized command execution on the affected system. The vulnerability is rated high severity with a CVSS score of 7, indicating significant risk if exploited. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided by the Python Software Foundation, users should monitor the vendor's advisories closely. Until a fix is available, avoid passing URLs containing "%action" to the webbrowser.open() API, especially in environments where untrusted input might be used. No other specific mitigations are documented.