← Vulnerability feed

Vulnerability record · CVE-2026-4786 · published 13 April 2026

CVE-2026-4786: Command injection vulnerability

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

7.0 CVSS 4.0 High EPSS 0.49% · top 60.7% CWE-77 · Command injectionCWE-88 · Argument injection Awaiting Analysis
7.0CVSS 4.0 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
58References
13 Aug 2026Last modified by NVD

Description

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53
https://github.com/python/cpython/commit/a4d3edf3a6ecfde504d02126410d2a65a859b744
https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca
https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff
https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4
https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769
https://github.com/python/cpython/issues/148169
https://github.com/python/cpython/pull/148170
https://mail.python.org/archives/list/[email protected]/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/
https://access.redhat.com/errata/RHSA-2026:10117
https://access.redhat.com/errata/RHSA-2026:10140
https://access.redhat.com/errata/RHSA-2026:10141
https://access.redhat.com/errata/RHSA-2026:10711
https://access.redhat.com/errata/RHSA-2026:10745
https://access.redhat.com/errata/RHSA-2026:10774
https://access.redhat.com/errata/RHSA-2026:10949
https://access.redhat.com/errata/RHSA-2026:10950
https://access.redhat.com/errata/RHSA-2026:11062
https://access.redhat.com/errata/RHSA-2026:11077
https://access.redhat.com/errata/RHSA-2026:11768
https://access.redhat.com/errata/RHSA-2026:13692
https://access.redhat.com/errata/RHSA-2026:13812
https://access.redhat.com/errata/RHSA-2026:14652
https://access.redhat.com/errata/RHSA-2026:14653
https://access.redhat.com/errata/RHSA-2026:14656
https://access.redhat.com/errata/RHSA-2026:16699
https://access.redhat.com/errata/RHSA-2026:17525
https://access.redhat.com/errata/RHSA-2026:17619
https://access.redhat.com/errata/RHSA-2026:19019
https://access.redhat.com/errata/RHSA-2026:19064
https://access.redhat.com/errata/RHSA-2026:19175
https://access.redhat.com/errata/RHSA-2026:19176
https://access.redhat.com/errata/RHSA-2026:19177
https://access.redhat.com/errata/RHSA-2026:19216
https://access.redhat.com/errata/RHSA-2026:19549
https://access.redhat.com/errata/RHSA-2026:19570
https://access.redhat.com/errata/RHSA-2026:19571
https://access.redhat.com/errata/RHSA-2026:19576
https://access.redhat.com/errata/RHSA-2026:19589
https://access.redhat.com/errata/RHSA-2026:19590

Track CVE-2026-4786 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-8037Progress LoadMaster API OS Command Injection RCEProgress LoadMaster (and related ADC products) contain an OS command injection flaw in multiple API command endpoints where unsanitized input is pass…KEVEPSS 77%analysed8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 13%analysed7.2CVE-2025-29635D-Link DIR-823X command injection in set_prohibiting handlerD-Link DIR-823X firmware (240126 and 240802) contains a command injection flaw in the /goform/set_prohibiting POST handler. An attacker who already h…KEVEPSS 88%analysed8.1CVE-2026-22719VMware Aria Operations command injection during support-assisted migrationVMware Aria Operations contains a command injection flaw (CWE-77) that an unauthenticated attacker can use to run arbitrary commands, potentially ach…KEVEPSS 18%analysed8.7CVE-2025-4008Meteobridge web interface command injection without authenticationThe Meteobridge web interface, built from CGI shell scripts and C, exposes an endpoint vulnerable to command injection. Because the endpoint also lac…KEVEPSS 94%analysed6.1CVE-2025-59689Libraesva ESG command injection via compressed email attachmentLibraesva Email Security Gateway versions 4.5 through 5.5.x before 5.5.7 are vulnerable to command injection triggered by a compressed email attachme…KEVEPSS 1.9%analysed9.8CVE-2025-10035Fortra GoAnywhere MFT License Servlet deserialization to command injectionThe License Servlet in Fortra GoAnywhere MFT deserializes untrusted data, and an attacker who can present a validly forged license response signature…KEVEPSS 100%analysed8.8CVE-2020-25079D-Link DCS cameras authenticated command injection in ddns_enc.cgiD-Link DCS-2530L (before 1.06.01 Hotfix) and DCS-2670L (through 2.02) contain an authenticated command injection flaw in cgi-bin/ddns_enc.cgi. A user…KEVEPSS 54%analysed

Source: NIST National Vulnerability Database (record CVE-2026-4786), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.