---
cve: "CVE-2026-4786"
severity: "HIGH"
cvss: 7.0
epss: "0.3%"
vendor: "Python Software Foundation"
kev: false
exploited: false
published: "2026-04-13 22:16:30"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-30T22:26:43+01:00"
---

# CVE-2026-4786

> 7.0 HIGH · 🧪 PoC

## Beschreibung

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

## CNA-Record (Kanon, cvelistV5)

- CNA: **PSF**
- State: PUBLISHED
- Stand: 2026-08-13 00:27:20
- CNA-CVSS: **7.0** (`CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Schwachstellen-Klasse

- **CWE-88** — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
  The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
- **CWE-77** — Improper Neutralization of Special Elements used in a Command ('Command Injection')
  The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

## Angriffsmuster (CAPEC)

- [CAPEC-41 — Using Meta-characters in E-mail Headers to Inject Malicious Payloads](https://capec.mitre.org/data/definitions/41.html) _(Severity: High)_
- [CAPEC-88 — OS Command Injection](https://capec.mitre.org/data/definitions/88.html) _(Severity: High)_
- [CAPEC-137 — Parameter Injection](https://capec.mitre.org/data/definitions/137.html) _(Severity: Medium)_
- [CAPEC-174 — Flash Parameter Injection](https://capec.mitre.org/data/definitions/174.html) _(Severity: Medium)_
- [CAPEC-460 — HTTP Parameter Pollution (HPP)](https://capec.mitre.org/data/definitions/460.html) _(Severity: Medium)_

## Patch verfügbar (OSV)

- 3a19c2f0b3e91ce8f23d0cc64d4c9ee557823f24 (Commit)
- 41388c9cb160d0886d5ca00d2e6c8782608a4549 (Commit)

## BSI-Hinweise (deutsch)

- [Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2455) — _BSI-Einstufung: hoch_
  Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- [IBM QRadar SIEM: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1666) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
- [CPython: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1087) — _BSI-Einstufung: mittel_
  Ein Angreifer kann mehrere Schwachstellen in Python ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.

## Referenzen

- <https://github.com/python/cpython/pull/148170>
- <https://github.com/python/cpython/issues/148169>
- <https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/>
- <https://github.com/python/cpython/commit/c5767a72838a8dda9d6dc5d3558075b055c56bca>
- <https://github.com/python/cpython/commit/d22922c8a7958353689dc4763dd72da2dea03fff>
- <https://github.com/python/cpython/commit/f4654824ae0850ac87227fb270f9057477946769>
- <https://github.com/python/cpython/commit/28b4ad38067bbdad34edfcd03ad2de5f06387e53>
- <https://github.com/python/cpython/commit/d6d68494be70bdbda20f89f83801ba52ec37daa4>
- <https://github.com/python/cpython/commit/a4d3edf3a6ecfde504d02126410d2a65a859b744>
- <https://access.redhat.com/errata/RHSA-2026:10117>
- <https://access.redhat.com/errata/RHSA-2026:10140>
- <https://access.redhat.com/errata/RHSA-2026:10141>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-4786/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_