FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

[3.12] Backport CVE-2026-4786: [3.10] gh-148169: Fix webbrowser `%action` substitution bypass of dash-prefix ch by vulgraph · Pull Request #149325 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

[3.12] Backport CVE-2026-4786: [3.10] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix ch - #149325

Closed
vulgraph wants to merge 1 commit into
python:3.12from
vulgraph:backport/CVE-2026-4786-3.12
ConversationCommits (1)ChecksFiles changed
Closed

[3.12] Backport CVE-2026-4786: [3.10] gh-148169: Fix webbrowser %action substitution bypass of dash-prefix ch#149325
vulgraph wants to merge 1 commit into
python:3.12from
vulgraph:backport/CVE-2026-4786-3.12

Conversation

vulgraph commented May 3, 2026

Copy link
Copy Markdown

Backport of upstream fix for CVE-2026-4786 to 3.12.

Apply was clean against the current tip of the target branch. No code changes on top of the upstream fix.

[3.10] pythongh-148169: Fix webbrowser %action substitution bypass …
9529566 
…of dash-prefix check (pythonGH-148170) (python#148521)

(cherry picked from commit d22922c)
(cherry picked from commit c5767a7)
bedevere-app Bot mentioned this pull request May 3, 2026
Closed

read-the-docs-community Bot commented May 3, 2026

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #32516939 | 📁 Comparing 9529566 against main (24c4aec)

  🔍 Preview build  

560 files changed · + 3 added · ± 506 modified · - 51 deleted

+ Added

± Modified

- Deleted

picnixz commented May 3, 2026

Copy link
Copy Markdown
Member

A backport already exists, please don't open PRs duplicating existing work.

picnixz closed this May 3, 2026

vulgraph commented May 3, 2026

Copy link
Copy Markdown
Author

Acknowledged. 3.12 is past the support window per your policy, closing on my end, thanks.

picnixz commented May 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

No, 3.12 is not past the support window for security branches. A PR already exists for the backport. And don't use LLMs to generate PRs, this is against our ToS if the content is not correctly reviewed: https://devguide.python.org/getting-started/generative-ai/.

vulgraph commented May 4, 2026

Copy link
Copy Markdown
Author

Thanks for the pointer, @picnixz. Closing as duplicate since the backport PR already exists.

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

awaiting review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL