Arbitrary Argument Injection SNYK-RHEL9-PYTHON3-16083644 #20174

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3 package and not the python3 package as distributed by RHEL.
See How to fix? for RHEL:9 relevant fixed versions and status.

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Remediation

Upgrade RHEL:9 python3 to version 0:3.9.25-3.el9_7.3 or higher.
This issue was patched in RHSA-2026:10949.

References

• https://access.redhat.com/security/cve/CVE-2026-4786
• webbrowser: %action substitution can bypass the dash-prefix check python/cpython#148169
• gh-148169: Fix webbrowser %action substitution bypass of dash-prefix check python/cpython#148170
• https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/
• python/cpython@c5767a7
• python/cpython@d22922c
• python/cpython@f465482
• python/cpython@28b4ad3
• python/cpython@d6d6849
• python/cpython@a4d3edf
• https://access.redhat.com/errata/RHSA-2026:10949
• https://bugzilla.redhat.com/show_bug.cgi?id=2458049
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4786.json