Every CVE Search/ Get API key

CVE-2026-7246

[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

7.2 HighFix availableDisputed

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.90%Up 0.9 points since May 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.2

[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Record
CVE-2026-7246
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-77, CWE-77, CWE-78
Updated
2026-11-02
EUVDEUVD-2026-26375 7.2

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Record
EUVD-2026-26375
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.2

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Record
CVE-2026-7246
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-77, CWE-78
Updated
2026-11-02
OSVBELL-CVE-2026-7246 7.2
Record
BELL-CVE-2026-7246
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.2

[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Record
CVE-2026-7246
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSVDEBIAN-CVE-2026-7246 7.2

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Record
DEBIAN-CVE-2026-7246
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVOESA-2026-2302 7.2

python-click security update

Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.

Security Fix(es):

Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)

Record
OESA-2026-2302
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2303 7.2

python-click security update

Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.

Security Fix(es):

Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)

Record
OESA-2026-2303
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2304 7.2

python-click security update

Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.

Security Fix(es):

Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)

Record
OESA-2026-2304
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2305 7.2

python-click security update

Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.

Security Fix(es):

Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)

Record
OESA-2026-2305
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVPYSEC-2026-2132 7.2

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Record
PYSEC-2026-2132
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:24761 7.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:24761
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:24762 8.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:24762
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-7246 7.2

(Pallets Click, versions 8.3.2 and below, contain a command injection v ...)

Record
UBUNTU-CVE-2026-7246
CVSS 3.1
7.2 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-86910 No score

CVE-2026-7246 affecting package python-click for versions less than 8.1.7-3

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Record
AZL-86910
Updated
2026-11-05
OSVopenSUSE-SU-2026:10760-1 No score

python311-click-8.3.3-2.1 on GA media

These are all security issues fixed in the python311-click-8.3.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10760-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21017-1 No score

Security update for python-click

This update for python-click fixes the following issue

  • CVE-2026-7246: Arbitrary command execution via command injection in click.edit() (bsc#1263898).
Record
openSUSE-SU-2026:21017-1
Updated
2026-11-02
OSVSUSE-SU-2026:22254-1 No score

Security update for python-click

This update for python-click fixes the following issue

  • CVE-2026-7246: Arbitrary command execution via command injection in click.edit() (bsc#1263898).
Record
SUSE-SU-2026:22254-1
Updated
2026-11-02
OSVSUSE-SU-2026:22321-1 No score

Security update for python-click

This update for python-click fixes the following issue

  • CVE-2026-7246: Arbitrary command execution via command injection in click.edit() (bsc#1263898).
Record
SUSE-SU-2026:22321-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-click
Azure Linux:3
before 8.1.7-3
8.1.7-3
py3-click
Alpaquita:stream
8.3.1-r0 up to 8.3.3-r0
8.3.3-r0
python-click
Debian:12
All versions, plus listed versions
8.1.3-28.1.6-18.1.6-28.1.7-18.1.7-2
Show 9 moreShow less
8.1.8-18.1.8-28.2.0+0.really.8.1.8-18.2.0+0.really.8.1.8-28.2.0-18.3.3-18.3.3-1~exp18.3.3-28.3.3-3
None known
python-click
Debian:13
All versions, plus listed versions
8.2.0+0.really.8.1.8-18.2.0+0.really.8.1.8-28.3.3-18.3.3-1~exp18.3.3-28.3.3-3
None known
python-click
Debian:14
before 8.3.3-1, plus listed versions
8.2.0+0.really.8.1.8-18.2.0+0.really.8.1.8-28.3.3-1~exp1
8.3.3-1
python-click
openEuler:24.03-LTS-SP1
before 8.1.7-2.oe2403sp1
8.1.7-2.oe2403sp1
python-click
openEuler:24.03-LTS-SP3
before 8.1.7-2.oe2403sp3
8.1.7-2.oe2403sp3
python-click
openEuler:22.03-LTS-SP4
before 8.0.4-2.oe2203sp4
8.0.4-2.oe2203sp4
python-click
openEuler:24.03-LTS
before 8.1.7-2.oe2403
8.1.7-2.oe2403
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
before 0:2.5.20260422-3.el8ap
0:2.5.20260422-3.el8ap
Show 71 moreShow less
Affected packages
PackageAffectedFixed
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
before 0:2.5.20260422-3.el9ap
0:2.5.20260422-3.el9ap
python3.12-click
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 16 CVEs
before 0:8.3.3-1.el8ap
0:8.3.3-1.el8ap
python3.12-click
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 16 CVEs
before 0:8.3.3-1.el8ap
0:8.3.3-1.el8ap
python3.12-click
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
before 0:8.3.3-1.el8ap
0:8.3.3-1.el8ap
python3.12-click
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 16 CVEs
before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 16 CVEs
before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
before 0:4.6.29-2.el8ap
0:4.6.29-2.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
before 0:4.6.29-2.el9ap
0:4.6.29-2.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 16 CVEs
before 0:1.6.5-1.el8ap
0:1.6.5-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 16 CVEs
before 0:1.6.5-1.el8ap
0:1.6.5-1.el8ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
before 0:2.5.10-6.el8ap
0:2.5.10-6.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
before 0:1.6.5-1.el8ap
0:1.6.5-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 16 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 16 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 16 CVEs
before 0:46.0.7-1.el8ap
0:46.0.7-1.el8ap
python3.12-cryptography
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 16 CVEs
before 0:46.0.7-1.el8ap
0:46.0.7-1.el8ap
python3.12-cryptography
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
before 0:46.0.7-1.el8ap
0:46.0.7-1.el8ap
python3.12-cryptography
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 16 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 16 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
before 0:12.2.0-1.el8ap
0:12.2.0-1.el8ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:2.6.9-1.el9ap
0:2.6.9-1.el9ap
python3-click
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 12 CVEs
before 0:8.3.3-1.el10ap
0:8.3.3-1.el10ap
python3-click
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
before 0:8.3.3-1.el10ap
0:8.3.3-1.el10ap
python3.12-click
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debuginfo
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debugsource
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debuginfo
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debugsource
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
python3.12-pillow-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
python3.12-pillow-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
python-click
SUSE:Linux Micro 6.2
before 8.2.1-160000.3.1
8.2.1-160000.3.1
python-click
SUSE:Linux Enterprise Server 16.0
before 8.2.1-160000.3.1
8.2.1-160000.3.1
python-click
SUSE:Linux Enterprise Server for SAP applications 16.0
before 8.2.1-160000.3.1
8.2.1-160000.3.1
python-click
openSUSE:Tumbleweed
before 8.3.3-2.1
8.3.3-2.1
python-click
openSUSE:Leap 16.0
before 8.2.1-160000.3.1
8.2.1-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-7246 is a high vulnerability (CVSS 7.2) in Pallets Click Click, published April 30, 2026. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in python-click 8.1.7-3.

References

Show 135 moreShow less
MoveEnter Open