CVE-2026-4786 — Vulnetix

CVE-2026-4786 PUBLISHED CVSS 7 HIGH

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

EPSS 0.02% · 6.2th percentile

Risk Scores

CVSS 4.0

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score

0.02%

6.2th percentile

Affected Products

Vendor	Product	Versions
Bitnami	libpython
Bitnami	python
Bitnami	python-min

Exploit Intelligence

CIRCL seen: CVE-2026-4786 (circl-sighting)
https://github.com/python/cpython/pull/148170 (circl)
https://github.com/python/cpython/issues/148169 (circl)
https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/ (circl)
BELL-CVE-2025-15282.json (github-poc)
BELL-CVE-2025-15282.json (github-poc)
BELL-CVE-2025-15282.json (github-poc)
BELL-CVE-2025-15282.json (github-poc)
BELL-CVE-2025-15282.json (github-poc)
BELL-CVE-2025-15282.json (github-poc)

…and 221 more exploits

Timeline

Apr 13, 2026 CVE Published
Apr 13, 2026 PoC Published
Apr 14, 2026 EPSS Score
Apr 14, 2026 Security Advisory
Apr 27, 2026 Distribution Patch
Apr 27, 2026 Security Advisory
Apr 27, 2026 Distribution Patch
Apr 27, 2026 Security Advisory
Apr 27, 2026 Distribution Patch
Apr 27, 2026 Security Advisory
Apr 27, 2026 Distribution Patch
Apr 27, 2026 Security Advisory

References

Open in Interactive Console →