Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Versions reported by the vendor

Affected version ranges reported by the assigning authority (PSF). Independent of NVD's CPE analysis and usually ahead of it.

• Python Software Foundation CPython

  • before 3.10.21affected · python
  • 3.11.0 and later · before 3.11.16affected · python
  • 3.12.0 and later · before 3.12.14affected · python
  • 3.13.0 and later · before 3.13.14affected · python
  • 3.14.0a1 and later · before 3.14.5rc1affected · python
  • 3.15.0a1 and later · before 3.15.0b1affected · python

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-115557Distrust compromised intermediate certificates in ssl module
  37Monitor
• CVE-2025-4517Arbitrary writes via tarfile realpath overflow
  37Monitor
• CVE-2026-19445Use-after-free of a server-side SSLContext when sni_callback switches contexts
  36Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-3446Apr 10, 2026 · Base64 decoding stops at first padded quad by default
  24Monitor
• ← EarlierCVE-2026-6100Apr 13, 2026 · Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
  36Monitor
• Later →CVE-2026-5713Apr 14, 2026 · Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.