CVE-2026-4786 is a high-severity vulnerability in Python's CPython webbrowser.open() API that allows command injection through crafted URLs containing "%action". This vulnerability is a bypass of the incomplete mitigation for CVE-2026-4519 and affects certain browser types. The underlying issue is improper handling of shell commands leading to arbitrary code execution. Red Hat has issued a security advisory and update for their Extended Life Cycle Support (ELS) Python packages to remediate this vulnerability.

Successful exploitation can lead to arbitrary code execution on the affected system via command injection in the webbrowser.open() API. This elevates the risk of unauthorized code execution with potential consequences depending on the context in which the API is used. The CVSS 4.0 base score is 7.0, indicating high severity with local attack vector, low attack complexity, partial attack type, no privileges required, user interaction required, and high impact on confidentiality and integrity.

A security update fixing CVE-2026-4786 is available from Red Hat for their Extended Life Cycle Support (ELS) Python packages. Users of affected Red Hat Enterprise Linux 6 ELS systems should apply the update as described in the Red Hat advisory (RHSA-2026:22144). No cloud service remediation applies as this is not a cloud service. Patch status is confirmed by the vendor advisory. Users should follow the vendor's update instructions at https://access.redhat.com/articles/11258 to remediate this vulnerability.