{"id":"CVE-2026-7246","state":"PUBLISHED","title":"[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename \"click.edit()\"","description":"This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:\n\nPallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.","publishedAt":"2026-04-30T13:16:44.050Z","updatedAt":"2026-08-18T20:50:52.262Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"certcc","products":["Pallets Click Click"],"affected":[{"vendor":"Pallets Click","product":"Click","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"8.3.3","versionType":"custom"}]}],"references":["https://github.com/pallets/click/releases/tag/8.3.3","https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw","https://access.redhat.com/security/cve/CVE-2026-7246","https://bugzilla.redhat.com/show_bug.cgi?id=2464121","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24761"],"weaknesses":["CWE-77","CWE-78"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7246.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7246","state":"PUBLISHED","datePublished":"2026-04-30T13:16:44.050Z","dateUpdated":"2026-08-18T20:50:52.262Z","assignerShortName":"certcc","assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateReserved":"2026-04-27T17:37:48.878Z"},"containers":{"cna":{"title":"[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename \"click.edit()\"","descriptions":[{"lang":"en","value":"This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:\n\nPallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account."}],"affected":[{"vendor":"Pallets Click","product":"Click","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"8.3.3","versionType":"custom"}]}],"references":[{"url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"PSF","orgId":"28c92f92-d60d-412d-b760-e73465c3df22","dateUpdated":"2026-08-18T20:50:52.262Z"},"source":{"discovery":"UNKNOWN"},"tags":["disputed"],"x_generator":{"engine":"VINCE 3.0.39","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-7246"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.2,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-04-30T13:39:25.058670Z","id":"CVE-2026-7246","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","type":"CWE","lang":"en","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-30T13:40:48.226Z"}},{"title":"github.com/pallets/click: Pallets Click: Arbitrary command execution via command injection in click.edit()","descriptions":[{"lang":"en","value":"A flaw was found in Pallets Click. This command injection vulnerability, located in the click.edit() function, allows an attacker with an unprivileged account to execute arbitrary operating system (OS) commands. This could lead to unauthorized control over the affected system."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","packageName":"python3.12-click","defaultStatus":"affected","versions":[{"version":"0:8.3.3-1.el8ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","packageName":"python3.12-click","defaultStatus":"affected","versions":[{"version":"0:8.3.3-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 10","packageName":"python-click","defaultStatus":"affected","versions":[{"version":"0:8.3.3-1.el10ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","packageName":"python3.12-click","defaultStatus":"affected","versions":[{"version":"0:8.3.3-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"python3.11-click","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"python3x-click","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-7246","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121","name":"RHBZ#2464121","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24762","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T00:40:20.632Z"},"datePublic":"2026-04-30T13:16:44.050Z","solutions":[{"lang":"en","value":"RHSA-2026:24762: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9"},{"lang":"en","value":"RHSA-2026:24761: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"}],"timeline":[{"lang":"en","time":"2026-04-30T14:00:58.850Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-30T13:16:44.050Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}