Logo
›
›vulnerability›CVE-2026-7246
Name
CVE-2026-7246
Source
NVD ( link)Debian ( link)
Description
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
CWEs
CWE-77 CWE-77 CWE-78
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/pallets/click/releases/tag/8.3.3Patch
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmwExploit
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmwExploit

Analysis#

Affected Component
Analysis
python3-click
Exploitable

Vulnerability Ratings#

7.2
CVSSv31
7.2
CVSSv31
NaN
other

Others affected component#

Name
Project
Project Version
Version
Status
python3-click
yocto
master
8.5.0
Not Affected