NVD

CVE-2026-4786 Detail

Awaiting Enrichment

This CVE record has been marked for NVD enrichment efforts.

Description

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

Nist CVSS score does not match with CNA score

CNA: Python Software Foundation

CVSS-B 7.0 HIGH

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

ADP: redhat-SADP

Base Score: 7.1 HIGH

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2026:10117	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10140	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10141	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10711	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10745	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10774	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10949	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10950	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:11062	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:11077	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:11768	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:13692	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:13812	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:14652	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:14653	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:14656	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:16699	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:17525	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:17619	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19019	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19064	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19175	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19176	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19177	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19216	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19549	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19570	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19571	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19576	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19589	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:19590	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:21275	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:21682	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:22144	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:25096	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:26187	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:28247	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:28581	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:30078	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:30087	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:30088	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:30089	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:35838	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:8822	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:8824	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:9228	redhat-SADP
https://access.redhat.com/security/cve/CVE-2026-4786	redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2458049	redhat-SADP
https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53	Python Software Foundation
https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca	Python Software Foundation
https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff	Python Software Foundation
https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4	Python Software Foundation
https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769	Python Software Foundation
https://github.com/python/cpython/issues/148169	Python Software Foundation
https://github.com/python/cpython/pull/148170	Python Software Foundation
https://mail.python.org/archives/list/[email protected]/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/	Python Software Foundation
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4786.json	redhat-SADP

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-77	Improper Neutralization of Special Elements used in a Command ('Command Injection')	Python Software Foundation
CWE-88	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')	redhat-SADP

Change History

7 change records found show changes

CVE Modified by redhat-SADP 7/06/2026 9:17:02 AM

Action

Type

Old Value

New Value

Added

Reference

https://access.redhat.com/errata/RHSA-2026:35838

Changed

Affected

Record truncated, showing 2048 of 7399 characters.
View Entire Change Record

[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server (v. 7 ELS)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server Optional (v. 7 ELS)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Middleware Containers for OpenShift","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhosemc:1.0::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v. 10.0)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.1","cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_e4s:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream TUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_tus:8.6::a

Record truncated, showing 2048 of 7268 characters.
View Entire Change Record

[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server (v. 7 ELS)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server Optional (v. 7 ELS)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Middleware Containers for OpenShift","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhosemc:1.0::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v. 10.0)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.1","cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_e4s:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream TUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_tus:8.6::a

CVE Modified by redhat-SADP 6/29/2026 11:20:42 PM

Action	Type	New Value
Added	CVSS V3.1	AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Added	CWE	CWE-88
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10117
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10140
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10141
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10711
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10745
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10774
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10949
Added	Reference	https://access.redhat.com/errata/RHSA-2026:10950
Added	Reference	https://access.redhat.com/errata/RHSA-2026:11062
Added	Reference	https://access.redhat.com/errata/RHSA-2026:11077
Added	Reference	https://access.redhat.com/errata/RHSA-2026:11768
Added	Reference	https://access.redhat.com/errata/RHSA-2026:13692
Added	Reference	https://access.redhat.com/errata/RHSA-2026:13812
Added	Reference	https://access.redhat.com/errata/RHSA-2026:14652
Added	Reference	https://access.redhat.com/errata/RHSA-2026:14653
Added	Reference	https://access.redhat.com/errata/RHSA-2026:14656
Added	Reference	https://access.redhat.com/errata/RHSA-2026:16699
Added	Reference	https://access.redhat.com/errata/RHSA-2026:17525
Added	Reference	https://access.redhat.com/errata/RHSA-2026:17619
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19019
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19064
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19175
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19176
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19177
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19216
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19549
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19570
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19571
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19576
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19589
Added	Reference	https://access.redhat.com/errata/RHSA-2026:19590
Added	Reference	https://access.redhat.com/errata/RHSA-2026:21275
Added	Reference	https://access.redhat.com/errata/RHSA-2026:21682
Added	Reference	https://access.redhat.com/errata/RHSA-2026:22144
Added	Reference	https://access.redhat.com/errata/RHSA-2026:25096
Added	Reference	https://access.redhat.com/errata/RHSA-2026:26187
Added	Reference	https://access.redhat.com/errata/RHSA-2026:28247
Added	Reference	https://access.redhat.com/errata/RHSA-2026:28581
Added	Reference	https://access.redhat.com/errata/RHSA-2026:30078
Added	Reference	https://access.redhat.com/errata/RHSA-2026:30087
Added	Reference	https://access.redhat.com/errata/RHSA-2026:30088
Added	Reference	https://access.redhat.com/errata/RHSA-2026:30089
Added	Reference	https://access.redhat.com/errata/RHSA-2026:8822
Added	Reference	https://access.redhat.com/errata/RHSA-2026:8824
Added	Reference	https://access.redhat.com/errata/RHSA-2026:9228
Added	Reference	https://access.redhat.com/security/cve/CVE-2026-4786
Added	Reference	https://bugzilla.redhat.com/show_bug.cgi?id=2458049
Added	Reference	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4786.json
Added	Affected	Record truncated, showing 2048 of 7399 characters. View Entire Change Record [{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server (v. 7 ELS)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server Optional (v. 7 ELS)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Middleware Containers for OpenShift","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhosemc:1.0::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v. 10.0)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.1","cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_e4s:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream TUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_tus:8.6::a

New CVE Received from Python Software Foundation 4/13/2026 6:16:30 PM

Action	Type	New Value
Added	Description	Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
Added	CVSS V4.0	AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Added	CWE	CWE-77
Added	Reference	https://github.com/python/cpython/issues/148169
Added	Reference	https://github.com/python/cpython/pull/148170
Added	Reference	https://mail.python.org/archives/list/[email protected]/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/

Quick Info

CVE Dictionary Entry:
CVE-2026-4786
NVD Published Date:
04/13/2026
NVD Last Modified:
07/06/2026
Source:
Python Software Foundation

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2026-4786 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Change History

CVE Modified by redhat-SADP 7/06/2026 9:17:02 AM

CVE Modified by redhat-SADP 6/29/2026 11:20:42 PM

CVE Modified by CISA-ADP 6/17/2026 6:57:13 AM

CVE Modified by Python Software Foundation 6/17/2026 6:57:13 AM

CVE Modified by Python Software Foundation 4/29/2026 12:16:26 PM

CVE Modified by Python Software Foundation 4/14/2026 11:16:39 AM

New CVE Received from Python Software Foundation 4/13/2026 6:16:30 PM

Quick Info