CVE-2026-4786

What it actually does

This vulnerability is an incomplete fix for a prior command injection issue in code paths that use Python-style webbrowser.open() behavior to launch URLs. If a crafted URL contains the substring "%action", certain browser-handling implementations can bypass the earlier mitigation and cause attacker-controlled content to be interpreted by the underlying shell. Successful exploitation can allow local command execution in the security context of the user who triggers the URL-opening action. The CVSS vector indicates local attack vector, low attack complexity, no privileges required, and required user interaction, with high confidentiality and integrity impact but no direct availability impact.

Why it matters to the business

An attacker who convinces a user or application workflow to open a maliciously crafted URL could run commands as that user, potentially leading to data theft, credential exposure, tampering with local files, or further compromise of developer and workstation systems. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS probability, and has no listed public exploit maturity, which lowers immediate internet-scale urgency; however, command injection flaws can become high-impact when embedded in desktop tools, developer utilities, or automation that opens untrusted links.

How an attack unfolds

An attacker prepares a specially crafted URL that includes "%action" and shell metacharacters or command payload content suitable for the affected browser-launch behavior. The attacker then gets a victim or a local application process to pass that URL into the vulnerable webbrowser.open() flow. Because the earlier mitigation does not fully handle the "%action" case, the URL may be transformed or passed in a way that reaches the operating system shell. On affected browser types and platforms, the shell interprets part of the URL as command syntax rather than inert URL data, resulting in execution of attacker-supplied commands under the current user account. From there, the attacker may collect local files, modify application configuration, plant persistence, or use stolen credentials for lateral movement.

How to fix it

Upgrade the affected software once vendor-fixed versions are available; no affected product list or exact fixed versions were provided in the input, so organizations should consult the relevant vendor advisory for CVE-2026-4786 and the prior CVE-2026-4519 fix lineage. If immediate upgrade is not possible, avoid passing untrusted URLs to webbrowser.open() or equivalent browser-launch APIs, strictly validate and allowlist URL schemes and characters, reject or percent-normalize dangerous tokens including "%action", and avoid shell invocation when launching browsers. Prefer APIs that pass arguments as structured arrays rather than command strings. Treat all externally supplied URLs as untrusted input and disable features that automatically open links from untrusted sources until patched.

How to confirm the fix worked

Confirm that the installed package or application version includes the vendor’s complete fix for both the original issue and the incomplete mitigation bypass. In test environments, attempt to open benign proof-of-concept URLs containing "%action" and harmless command separators, verifying that no shell command is executed and that the URL is either rejected, safely opened as data, or sanitized. Review source or configuration to ensure browser launches do not use shell=True or string-concatenated command lines with untrusted URL input. Validate that URL allowlisting rejects unexpected schemes, shell metacharacters, and special browser action placeholders.

Typical attack path

1. Identify an application, script, desktop tool, or automation path that opens externally supplied URLs using the vulnerable webbrowser.open() behavior.
2. Craft a malicious URL containing "%action" plus command-injection syntax tailored to the victim operating system and configured browser.
3. Deliver the URL through a document, webpage, chat message, issue tracker entry, email, local file, or other workflow likely to be opened by the user or application.
4. Rely on user interaction or an application action to trigger URL opening.
5. Bypass the incomplete mitigation and cause the underlying shell to execute injected commands.
6. Use the resulting user-level command execution to access files, steal credentials, alter configuration, or stage follow-on tooling.

How to detect it

Look for evidence that suspicious URLs containing "%action" were opened shortly before unexpected local command execution. Relevant sources include endpoint detection telemetry, process creation logs, shell history, application logs that record opened URLs, browser helper logs, email/web proxy logs, ticketing or chat attachment/link logs, and operating system audit events. Hunt for command shells or scripting interpreters spawned by applications that normally only open links, such as desktop clients, document viewers, Python-based tools, IDEs, chat clients, or browser-launch helper processes. On Windows, review process creation events for cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or certutil.exe launched from unexpected parent applications near a URL open event. On macOS/Linux, review executions of sh, bash, zsh, curl, wget, osascript, python, perl, or ruby with suspicious parents. Search application and proxy logs for "%action" in URLs, including encoded or partially encoded variants, and correlate hits with endpoint process execution and file modification activity. Because no public exploit maturity or named threat actors were provided, detection should focus on generic command-injection behavior and the unique bypass token.

• %action
• %25action
• webbrowser.open(
• cmd.exe
• powershell.exe
• pwsh.exe
• /bin/sh
• /bin/bash
• /bin/zsh
• osascript
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe
• curl
• wget

What your security team should do

• Inventory applications, scripts, packaged tools, and developer utilities that accept external URLs and invoke webbrowser.open() or equivalent browser-launch APIs.
• Prioritize remediation for user workstations, developer systems, build environments, helpdesk tools, and automation platforms that may open links from untrusted sources.
• Apply the vendor patch as soon as a fixed version is identified, ensuring the update addresses the incomplete mitigation bypass as well as the original command injection condition.
• Implement compensating controls that block or sanitize URLs containing "%action" where such URLs are not business-required.
• Harden endpoint controls to detect suspicious child processes spawned from browsers, desktop applications, scripting runtimes, or URL-opening helper processes.
• Educate users to avoid opening unexpected links in documents, tickets, chats, and emails, especially where desktop tools process those links automatically.
• Because EPSS is low and there is no known KEV/ransomware use, prioritize based on exposure to untrusted URL input rather than broad emergency response.