Read the docs
TI-2026-06360 Aliases CVE-2026-7246

[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

Priority HIGH 67CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-77.

Summary

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.009 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Click (Pallets Click): 8.3.3Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Pallets ClickClickbefore 8.3.38.3.3Patch availableCNA
  • Click VendorPallets Click Affected before 8.3.3 Fixed in 8.3.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:palletsprojects:click:*:*:*:*:*:*:*:*before 8.3.3Vulnerablepallets
  • cpe:2.3:a:palletsprojects:click:*:*:*:*:*:*:*:* Versions before 8.3.3 Vulnerable ·pallets

Remediation

  • Fix · CNA Click (Pallets Click) Fixed in 8.3.3

Red Hat 4 advisories

  • RHSA-2026:73930 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (rocm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:73929 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:24761 Released 2026-06-09 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.29-2.el8ap, automation-gateway-proxy-server-2.5.10-6.el8ap, automation-gateway-server-2.5.20260422-3.el8ap +4
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.29-2.el9ap, automation-gateway-proxy-server-2.6.14-3.el9ap, automation-gateway-server-2.5.20260422-3.el9ap +4
Show 1 more Red Hat advisories
  • RHSA-2026:24762 Released 2026-06-09 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python3-click-8.3.3-1.el10ap, receptor-1.6.5-1.el10ap, receptorctl-1.6.5-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.12-1.el9ap, automation-controller-cli-4.7.12-1.el9ap, automation-controller-server-4.7.12-1.el9ap +10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference Server 3.2Fixed RHSA-2026:73929, RHSA-2026:73930
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:24761
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:24761
Red Hat Ansible Automation Platform 2.6 for RHEL 10Fixed RHSA-2026:24762
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:24762
Not affected: 5 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7246

References

Exploit 1

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences