This vulnerability (CVE-2026-4786) in CPython is a command injection issue (CWE-77) related to the webbrowser.open() API. The problem stems from an incomplete fix for CVE-2026-4519, where URLs containing "%action" can bypass the mitigation on certain browsers, enabling command injection into the shell. The vulnerability is present in CPython versions 3.14.0a1 and 3.15.0a1. The CVSS 4.0 score is 7.0, indicating high severity, with attack vector local, low attack complexity, partial attack type, no privileges required, user interaction required, and high impact on confidentiality and integrity. No official patch or remediation level has been published yet.

Successful exploitation could allow an attacker to inject commands into the underlying shell via the webbrowser.open() API when processing specially crafted URLs containing "%action". This could lead to unauthorized command execution with potential impact on confidentiality and integrity of the affected system. The vulnerability requires local access and user interaction, limiting remote exploitation scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by the Python Software Foundation, users should monitor for updates and avoid processing untrusted URLs containing "%action" with the webbrowser.open() API. Restricting usage or applying additional input validation may reduce risk until an official fix is available.