Skip to content
Fencer Vulns
high 7.2

CVE-2026-7246 json

[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

published 2026-04-30 6 mo ago modified 2026-10-26 13 d ago also GHSA-47fr-3ffg-hgmw , PYSEC-2026-2132 , EUVD-2026-26375

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Patch / fix

  • Pallets Click Click 8.3.3
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:8.3.3-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:8.3.3-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10 0:8.3.3-1.el10ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:8.3.3-1.el9ap
  • python-click Debian 14 8.3.3-1

debian advisories DEBIAN-CVE-2026-7246

  • receptor ansible automation platform 2.6 1.6.5-1.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.5-1.el9ap
  • receptorctl ansible automation platform 2.6 1.6.5-1.el10ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.5-1.el9ap
  • python3-click ansible automation platform developer 2.6, ansible automation platform 2.6 8.3.3-1.el10ap
  • python3.12-click ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 8.3.3-1.el9ap
  • python3.12-pillow ansible automation platform 2.6, ansible automation platform 2.5 12.2.0-1.el9ap
  • automation-controller ansible automation platform developer 2.6, ansible automation platform 2.6 4.7.12-1.el9ap

red hat advisories RHSA-2026:24762RHSA-2026:24761

  • python-click SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 8.2.1-160000.3.1

suse advisories SUSE-SU-2026:22254-1SUSE-SU-2026:22321-1

  • python-click openSUSE Leap 16.0 8.2.1-160000.3.1
  • python-click openSUSE Tumbleweed 8.3.3-2.1

opensuse advisories openSUSE-SU-2026:21017-1openSUSE-SU-2026:10760-1

  • python-click Azure Linux 3.0 8.1.7-3

azure linux advisories AZL-86910

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-7246 updated cvss 7.2

github.com/pallets/click: Pallets Click: Arbitrary command execution via command injection in click.edit()

  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1790621718, rhaiis/vllm-rocm-rhel9 1790621713
    fixed: vendor fix RHSA-2026:73929
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-click 8.3.3-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-click 8.3.3-1.el9ap
    fixed: vendor fix RHSA-2026:24761
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-click 8.3.3-1.el9ap Red Hat Ansible Automation Platform 2.6 for RHEL 10 python3-click 8.3.3-1.el10ap
    fixed: vendor fix RHSA-2026:24762
  • Red Hat Ansible Automation Platform 2 python3x-click, python3.11-click Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.5-1.el8ap, receptorctl 1.6.5-1.el8ap, automation-hub 4.10.15-1.el8ap, python3.12-pillow 12.2.0-1.el8ap, python3.12-pulpcore 3.49.61-1.el8ap, automation-controller 4.6.29-2.el8ap, +12 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.5-1.el9ap, receptorctl 1.6.5-1.el9ap, automation-hub 4.10.15-1.el9ap, python3.12-pillow 12.2.0-1.el9ap, python3.12-pulpcore 3.49.61-1.el9ap, automation-controller 4.6.29-2.el9ap, +12 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.5-1.el9ap, molecule 26.4.0-2.el9ap, receptorctl 1.6.5-1.el9ap, ansible-sign 0.1.5-1.el9ap, ansible-lint 26.4.0-1.el9ap, automation-hub 4.11.9-1.el9ap, +37 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.5-1.el10ap, molecule 26.4.0-2.el10ap, receptorctl 1.6.5-1.el10ap, ansible-sign 0.1.5-1.el10ap, python-click 8.3.3-1.el10ap, ansible-lint 26.4.0-1.el10ap, +11 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CNA 3.1 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected products

  • Pallets Click Click
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.