CVE-2026-7246

7.2 Élevée

Publiée le 30/04/2026 à 16:16 · Modifiée le 18/08/2026 à 23:18 · Modifiée · Source : cna@python.org

Description

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Traduire en français

Produits concernés

Pallets Click Click
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 10
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Ansible Automation Platform 2
Palletsprojects click

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H`
3.1	7.2 Élevée	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	`CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-77
CWE-78

Références

https://github.com/pallets/click/releases/tag/8.3.3 PatchProduct
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw ExploitThird Party Advisory
https://access.redhat.com/errata/RHSA-2026:24761
https://access.redhat.com/errata/RHSA-2026:24762
https://access.redhat.com/security/cve/CVE-2026-7246
https://bugzilla.redhat.com/show_bug.cgi?id=2464121
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw ExploitThird Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories