CVE-2026-4786 is a vulnerability in the Python webbrowser.open() API where specially crafted URLs containing "%action" can lead to command injection and arbitrary code execution. This vulnerability bypasses a prior mitigation for CVE-2026-4519. Red Hat Product Security has rated this issue as important and has released updated Python packages for affected Red Hat Enterprise Linux 6 Extended Life Cycle Support Extension products. The vulnerability is characterized by improper neutralization of argument delimiters in a command (CWE-88). The CVSS v3 base score assigned by Red Hat is 7.1 (High), with network attack vector, high attack complexity, no privileges required, and user interaction required. The impact includes unauthorized code execution, data confidentiality and integrity compromise, and limited availability impact.

An attacker can exploit this vulnerability to inject commands into the underlying shell via the webbrowser.open() API, potentially leading to arbitrary code execution. This can result in unauthorized code execution, alteration of execution logic, and unauthorized reading or modification of application data. The vulnerability has a high confidentiality and integrity impact, with a low availability impact. No known exploits in the wild have been reported at this time.

Red Hat has released updated Python packages for affected products that address this vulnerability. Users should apply the security updates provided by Red Hat for Red Hat Enterprise Linux 6 Extended Life Cycle Support Extension to remediate this issue. Currently, no alternative mitigations meet Red Hat's criteria for ease of use, applicability, or stability. Users are advised to upgrade to the fixed versions as soon as possible. For detailed update instructions, refer to Red Hat's official advisory and knowledge base articles.