This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-4786 →

ALPINE-CVE-2026-4786

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.o...

Original description

The description as published by the source.

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.21 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]

Alpine:v3.22 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]

Alpine:v3.23 python3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.14-r0"}]}]

References

advisory security.alpinelinux.org