CVE-2026-4786: Python webbrowser RCE Vulnerability

CVE-2026-4786 Overview

CVE-2026-4786 is a command injection vulnerability in Python's webbrowser module that represents an incomplete mitigation of CVE-2026-4519. When a URL contains %action, the original security mitigation can be bypassed for certain browser types, allowing attackers to inject commands into the underlying shell through the webbrowser.open() API. This bypass vulnerability demonstrates the challenges of properly sanitizing user-controlled input in security-sensitive contexts.

Critical Impact

Successful exploitation allows attackers to execute arbitrary shell commands on the target system through maliciously crafted URLs, bypassing the security controls implemented for CVE-2026-4519.

Affected Products

• Python CPython (multiple versions)
• Applications using the webbrowser.open() API with user-controlled URLs
• Systems with vulnerable browser configurations

Discovery Timeline

• 2026-04-13 - CVE CVE-2026-4786 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-4786

Vulnerability Analysis

This command injection vulnerability (CWE-77) stems from an incomplete fix for the original CVE-2026-4519 issue in Python's webbrowser module. The vulnerability requires local access and user interaction to exploit, where an attacker must convince a user to open a specially crafted URL. When successful, the attacker can achieve high confidentiality and integrity impact on the vulnerable system.

The core issue lies in how the webbrowser module handles URL substitution with %action patterns. The original mitigation implemented a _check_url() function to validate URLs before processing, but this check could be bypassed when the URL contained specific %action substitution sequences that were processed after the validation occurred.

Root Cause

The root cause is an improper input validation sequence in the webbrowser.open() function. The _check_url() validation was performed before the %action substitution occurred, allowing attackers to craft URLs that pass the initial check but result in malicious command strings after substitution processing. This is a classic case of validation bypass through transformation ordering issues.

Attack Vector

The attack vector is local, requiring the attacker to have some form of access to influence the URL parameter passed to webbrowser.open(). The attack requires user interaction (UI:A) and specific preconditions to be met (AT:P), including the use of certain browser types that are susceptible to shell command injection. An attacker would craft a URL containing %action sequences that, after substitution, result in shell metacharacters or commands being injected into the browser execution command line.

# Security patch in Lib/webbrowser.py
# The fix repositions URL validation to occur after %action substitution
 
    def open(self, url, new=0, autoraise=True):
        sys.audit("webbrowser.open", url)
-        self._check_url(url)
        if new == 0:
            action = self.remote_action
        elif new == 1:

Source: GitHub Commit c5767a7

Detection Methods for CVE-2026-4786

Indicators of Compromise

• Monitor for URLs containing %action patterns being passed to Python applications using the webbrowser module
• Look for unusual shell command execution following browser launch operations
• Check for unexpected child processes spawned from Python applications that use browser automation
• Audit application logs for malformed URL patterns with shell metacharacters

Detection Strategies

• Implement application-level logging for all webbrowser.open() calls with full URL parameter capture
• Deploy endpoint detection rules to flag Python processes spawning unexpected shell commands
• Monitor system audit logs for webbrowser.open audit events using Python's sys.audit() framework
• Create SIEM rules to correlate browser launch events with suspicious command execution patterns

Monitoring Recommendations

• Enable Python audit hooks to capture all webbrowser.open events in security-sensitive environments
• Implement URL allowlisting for applications that programmatically open browser windows
• Deploy SentinelOne behavioral AI to detect anomalous process chains originating from Python interpreters
• Monitor for exploitation attempts by tracking URLs with %action substitution patterns in web application firewalls

How to Mitigate CVE-2026-4786

Immediate Actions Required

• Update Python to the latest patched version that addresses this bypass vulnerability
• Review all application code that uses webbrowser.open() with user-controlled input
• Implement additional input validation before passing URLs to the webbrowser module
• Consider disabling or restricting browser automation features in security-sensitive deployments

Patch Information

The Python development team has released patches across multiple branches to address this vulnerability. The fix involves repositioning the URL validation check to occur at the correct point in the processing sequence, ensuring that %action substitution cannot bypass security controls.

Relevant patches are available through the following commits:

• Commit c5767a7 for Python 3.10
• Commit d22922c for the main branch
• Commit f465482 for Python 3.11

For additional details, see the Python Security Announcement and GitHub Issue #148169.

Workarounds

• Sanitize all URLs before passing them to webbrowser.open(), specifically filtering %action and other potentially dangerous patterns
• Implement a strict URL allowlist that only permits known-safe URL schemes and domains
• Use alternative browser launching mechanisms that don't rely on shell command execution
• Deploy application sandboxing to limit the impact of potential command injection

# Configuration example - Input validation before webbrowser.open()
# Add this validation to your Python application code:

# Validate URLs before passing to webbrowser module
# Reject URLs containing %action or shell metacharacters
# Example: if re.search(r'%action|[;&|`$]', url): raise ValueError("Invalid URL")