CVE-2026-7246: [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

Description

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Attack vector

Local

Complexity

High

Privileges

High

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 59% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CL

Click · Pallets Click

before 8.3.3 · source: vendor, NVD

RH

Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat Ansible Automation Platform 2.6 for RHEL 10 · Red Hat

All versions, or not specified · source: CISA

RH

Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat

All versions, or not specified · source: CISA