Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
| Vendor | Product | Versions |
|---|---|---|
| python software foundation | python | 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| fedora | fedora linux | cert_advisory | 90% |
| open source | python | cert_advisory | 90% |
Updated description with new details, changed severity to CRITICAL, added affected version 3.14.x, and noted no exploit is available.
Updated severity to HIGH, marked exploit as available, and noted that it is actively exploited.
Initial creation
