The vulnerability arises from incomplete mitigation of a prior issue (CVE-2026-4519). When a URL containing the string '%action' is passed to Python's webbrowser.open() function, the %action sequence is expanded by certain browsers, allowing an attacker to inject commands into the underlying system shell. This bypasses the existing safeguard and can execute arbitrary shell commands. The weakness is a classic command injection problem (CWE-77).

The affected product is the CPython interpreter, maintained by the Python Software Foundation. No specific version range is listed in the CNA data, so any CPython installation that includes the vulnerable webbrowser.open implementation may be affected until the patch is applied. Review releases following the GitHub pull request to identify impacted releases.

The CVSS base score is 7, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no known widespread exploitation yet. The likely attack requires a crafted URL string to be processed by an application that calls webbrowser.open. An attacker would need the ability to influence that input, which could be within a local environment or within a web application that passes user‑provided URLs. Thus the risk is moderate to high, depending on deployment context. Prompt patching mitigates the risk.