Affected: Alpaquita:stream: py3-click

Affected: Homebrew: acronym

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Withdrawn by the publisher.

Affected: CleanStart: apache-superset

Package apache-superset version 5.0.0-r8 fixes 6 vulnerabilities: ghsa-537c-gmf6-5ccf, CVE-2026-34180, ghsa-6v7p-g79w-8964, CVE-2026-57585, CVE-2026-44405...

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Affected: openEuler:24.03-LTS-SP1: python-click

Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box. Security Fix(es):

Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)

python311-click-8.3.3-2.1 on GA media

Affected: PyPI: click

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions github.com/pallets/click: Pallets Click: Arbitrary command execution via command injection in click.edit() minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance Vite: Vite: Information disclosure via WebSocket connection bypasses access control cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

Security update for python-click

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: python-click, Ubuntu:18.04:LTS: python-click, Ubuntu:20.04:LTS: python-click, Ubuntu:22.04:LTS: python-click, Ubuntu:24.04:LTS: python-click, Ubuntu:25.10: python-click, Ubuntu:26.04: python-click

(Pallets Click, versions 8.3.2 and below, contain a command injection v ...)

Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.