CVE-2026-4786 is a command injection vulnerability in the Python webbrowser.open() API. If a URL containing the string "%action" is processed, it can bypass the mitigation implemented for CVE-2026-4519, allowing an attacker to inject commands into the underlying shell and achieve arbitrary code execution. This flaw affects CPython versions including 3.11.0, 3.12.0, 3.13.0, 3.14.0, 3.15.0, and their alpha releases. The vulnerability is tracked under CWE-77 and CWE-88, indicating improper neutralization of argument delimiters leading to command injection. Red Hat has published advisories and released security updates for affected products, particularly for Red Hat Enterprise Linux Extended Lifecycle Support versions. However, a general mitigation for all affected versions is not currently available or does not meet Red Hat's criteria for deployment.

An attacker can exploit this vulnerability by crafting a URL containing "%action" that, when processed by the webbrowser.open() API, injects arbitrary commands into the underlying shell. This can lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability bypasses a previous mitigation, increasing the risk of exploitation. The CVSS v3 score is 7.1 (high severity), with high impact on confidentiality and integrity, and low impact on availability. No known exploits in the wild have been reported.

Red Hat has released security updates addressing CVE-2026-4786 for their supported products, including Red Hat Enterprise Linux Server Extended Lifecycle Support Extension 6. Users should apply these updates as soon as possible. Currently, no universal mitigation is available or meets Red Hat's criteria for ease of use and deployment. Users of affected CPython versions should monitor vendor advisories for patches and updates. For Red Hat customers, consulting with a Technical Account Manager (TAM) is recommended for tailored guidance. No additional mitigations are specified beyond applying the vendor-provided updates.