Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
2.5.3-62.5.3-72.5.3-82.5.3-92.5.3-9ubuntu0.12.7.1+repack-22.7.1+repack-32.7.1+repack-5~18.042.7.1+repack1-4build12.7.1+repack1-4build22.7.2~b2+repack1-1ubuntu17.1.1+dfsg-17.2.0+dfsg-17.3.0+dfsg-17.3.0+dfsg-1ubuntu27.3.0+dfsg-1ubuntu37.3.1+dfsg-47.3.1+dfsg-4ubuntu0.13.10.12-1~22.04.163.12.3-1ubuntu0.152.7.3+repack1-17.3.19+dfsg-17.3.19+dfsg-27.3.20+dfsg-17.3.20+dfsg-33.13.3-13.13.3-23.13.3-43.13.4-13.13.5-13.13.5-23.13.6-13.13.7-13.13.7-1ubuntu0.13.13.7-1ubuntu0.2+2 more3.14.0-13.14.0-1ubuntu0.13.14.0-1ubuntu0.23.14.0-1ubuntu0.33.14.0~a7-0ubuntu13.14.0~b1-13.14.0~b3-13.14.0~rc1-13.14.0~rc2-13.14.0~rc3-1Exploitability
AV:LAC:LAT:PPR:NUI:AVulnerable System
VC:HVI:HVA:NSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N