Description
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Pallets Click Click
Default version status: unaffected
0 to < 8.3.3affected
References
- https://github.com/pallets/click/releases/tag/8.3.3 ↗
- https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw ↗
- https://access.redhat.com/security/cve/CVE-2026-7246 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2464121 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json ↗
- https://access.redhat.com/errata/RHSA-2026:24762 ↗
- https://access.redhat.com/errata/RHSA-2026:24761 ↗