CPython webbrowser %action substitution bypass leading to command injection

#!/usr/bin/env python3
"""
check_cve_2026_4786.py

Detects whether the local Python interpreter's stdlib webbrowser.py
contains the follow-up fix for CVE-2026-4786.

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN / could not determine
"""

import inspect
import os
import sys

try:
    import webbrowser
except Exception as exc:
    print(f"UNKNOWN: failed to import webbrowser: {exc}")
    sys.exit(2)


def main() -> int:
    path = getattr(webbrowser, "__file__", None)
    if not path or not os.path.exists(path):
        print(f"UNKNOWN: could not locate webbrowser.py (path={path!r})")
        return 2

    try:
        with open(path, "r", encoding="utf-8") as f:
            src = f.read()
    except Exception as exc:
        print(f"UNKNOWN: failed to read {path}: {exc}")
        return 2

    # Fixed follow-up logic from the upstream patch:
    #   self._check_url(url.replace("%action", action))
    #   arg.replace("%action", action).replace("%s", url)
    patched_markers = [
        'self._check_url(url.replace("%action", action))',
        "self._check_url(url.replace('%action', action))",
        'replace("%action", action).replace("%s", url)',
        "replace('%action', action).replace('%s', url)",
    ]

    # Vulnerable/incomplete-fix logic seen before the follow-up patch:
    #   self._check_url(url)
    #   arg.replace("%s", url).replace("%action", action)
    vulnerable_markers = [
        'self._check_url(url)',
        'replace("%s", url).replace("%action", action)',
        "replace('%s', url).replace('%action', action)",
    ]

    has_patched = any(marker in src for marker in patched_markers)
    has_vuln = all(marker in src for marker in vulnerable_markers)

    print(f"Interpreter: {sys.executable}")
    print(f"Version: {sys.version.split()[0]}")
    print(f"Module: {path}")

    if has_patched:
        print("PATCHED")
        return 0

    if has_vuln:
        print("VULNERABLE")
        return 1

    print("UNKNOWN")
    print("Reason: webbrowser.py does not clearly match either the known vulnerable or known patched code pattern; this may be a downstream backport or modified runtime.")
    return 2


if __name__ == "__main__":
    sys.exit(main())