Search
Find a vulnerability
Search criteria
Related vulnerabilities
BREW-ACRONYM-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:34 – Updated: 2026-09-17 18:47 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "acronym",
"purl": "pkg:brew/acronym"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-acronym-CVE-2026-7246",
"modified": "2026-09-17T18:47:55Z",
"published": "2026-08-13T16:34:58Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ADR-VIEWER-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-18 14:56 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "adr-viewer",
"purl": "pkg:brew/adr-viewer"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.4.0_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-adr-viewer-CVE-2026-7246",
"modified": "2026-09-18T14:56:30Z",
"published": "2026-08-13T16:35:11Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-AIDER-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-08-13 16:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "aider",
"purl": "pkg:brew/aider"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-aider-CVE-2026-7246",
"modified": "2026-08-13T16:35:12Z",
"published": "2026-08-13T16:35:12Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-AIRSHARE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-10-02 10:45 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | |
|---|---|---|
BREW-ANIMDL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-08-13 16:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.8",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "animdl",
"purl": "pkg:brew/animdl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.8",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.8"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-animdl-CVE-2026-7246",
"modified": "2026-08-13T16:35:16Z",
"published": "2026-08-13T16:35:16Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ANSIBLE-LINT-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-10 18:50 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible-lint",
"purl": "pkg:brew/ansible-lint"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-ansible-lint-CVE-2026-7246",
"modified": "2026-09-10T18:50:57Z",
"published": "2026-08-13T16:35:16Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-APKLEAKS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-08-13 16:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "apkleaks",
"purl": "pkg:brew/apkleaks"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.3_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-apkleaks-CVE-2026-7246",
"modified": "2026-08-13T16:35:54Z",
"published": "2026-08-13T16:35:54Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-APPRISE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-02 08:44 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "apprise",
"purl": "pkg:brew/apprise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-apprise-CVE-2026-7246",
"modified": "2026-09-02T08:44:40Z",
"published": "2026-08-13T16:35:55Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ARCHGW-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:36 – Updated: 2026-10-02 08:49 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "archgw",
"purl": "pkg:brew/archgw"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.7"
},
{
"fixed": "0.3.22_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-archgw-CVE-2026-7246",
"modified": "2026-10-02T08:49:43Z",
"published": "2026-08-13T16:36:04Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ATHENACLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:36 – Updated: 2026-10-02 09:15 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "athenacli",
"purl": "pkg:brew/athenacli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-athenacli-CVE-2026-7246",
"modified": "2026-10-02T09:15:04Z",
"published": "2026-08-13T16:36:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-AWS-SAM-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-08-13 16:37 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.8",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "aws-sam-cli",
"purl": "pkg:brew/aws-sam-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.8",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.8"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-aws-sam-cli-CVE-2026-7246",
"modified": "2026-08-13T16:37:01Z",
"published": "2026-08-13T16:37:01Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-AWS-SSO-UTIL-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-10-02 09:46 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "aws-sso-util",
"purl": "pkg:brew/aws-sso-util"
},
"ranges": [
{
"events": [
{
"introduced": "4.25.0"
},
{
"fixed": "4.33.0_7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-aws-sso-util-CVE-2026-7246",
"modified": "2026-10-02T09:46:05Z",
"published": "2026-08-13T16:37:01Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BACKGROUNDREMOVER-C… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-10-02 08:49 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "backgroundremover",
"purl": "pkg:brew/backgroundremover"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.7"
},
{
"fixed": "0.4.1_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-backgroundremover-CVE-2026-7246",
"modified": "2026-10-02T08:49:18Z",
"published": "2026-08-13T16:37:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BAGELS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-10-02 08:50 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "bagels",
"purl": "pkg:brew/bagels"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.6"
},
{
"fixed": "0.3.12_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-bagels-CVE-2026-7246",
"modified": "2026-10-02T08:50:38Z",
"published": "2026-08-13T16:37:04Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BEANCOUNT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-09-17 17:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.3",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "beancount",
"purl": "pkg:brew/beancount"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.3",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.3"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-beancount-CVE-2026-7246",
"modified": "2026-09-17T17:35:15Z",
"published": "2026-08-13T16:37:11Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BEANQUERY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-09-17 18:28 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "beanquery",
"purl": "pkg:brew/beanquery"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.0"
},
{
"fixed": "0.2.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-beanquery-CVE-2026-7246",
"modified": "2026-09-17T18:28:06Z",
"published": "2026-08-13T16:37:11Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BILIX-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-09-17 18:28 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "bilix",
"purl": "pkg:brew/bilix"
},
"ranges": [
{
"events": [
{
"introduced": "0.18.3"
},
{
"fixed": "0.18.9_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-bilix-CVE-2026-7246",
"modified": "2026-09-17T18:28:29Z",
"published": "2026-08-13T16:37:13Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BLACK-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:38 – Updated: 2026-10-06 08:51 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "black",
"purl": "pkg:brew/black"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.5.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-black-CVE-2026-7246",
"modified": "2026-10-06T08:51:47Z",
"published": "2026-08-13T16:38:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BUKU-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:38 – Updated: 2026-09-18 15:05 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "buku",
"purl": "pkg:brew/buku"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1_6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-buku-CVE-2026-7246",
"modified": "2026-09-18T15:05:56Z",
"published": "2026-08-13T16:38:25Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-BUMP-MY-VERSION-CVE… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:38 – Updated: 2026-09-17 19:37 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "bump-my-version",
"purl": "pkg:brew/bump-my-version"
},
"ranges": [
{
"events": [
{
"introduced": "0.26.0"
},
{
"fixed": "1.3.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-bump-my-version-CVE-2026-7246",
"modified": "2026-09-17T19:37:47Z",
"published": "2026-08-13T16:38:25Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CASSANDRA-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:38 – Updated: 2026-08-13 16:38 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cassandra",
"purl": "pkg:brew/cassandra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cassandra-CVE-2026-7246",
"modified": "2026-08-13T16:38:58Z",
"published": "2026-08-13T16:38:58Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CCM-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-08-13 16:39 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "ccm",
"purl": "pkg:brew/ccm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.5_6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-ccm-CVE-2026-7246",
"modified": "2026-08-13T16:39:03Z",
"published": "2026-08-13T16:39:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CEKIT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-09-17 19:55 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cekit",
"purl": "pkg:brew/cekit"
},
"ranges": [
{
"events": [
{
"introduced": "4.10.0"
},
{
"fixed": "4.16.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cekit-CVE-2026-7246",
"modified": "2026-09-17T19:55:21Z",
"published": "2026-08-13T16:39:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CERTSYNC-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-10-02 10:40 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "certsync",
"purl": "pkg:brew/certsync"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.6_11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-certsync-CVE-2026-7246",
"modified": "2026-10-02T10:40:52Z",
"published": "2026-08-13T16:39:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CF2TF-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-09-05 08:44 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cf2tf",
"purl": "pkg:brew/cf2tf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.2_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cf2tf-CVE-2026-7246",
"modified": "2026-09-05T08:44:01Z",
"published": "2026-08-13T16:39:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CFN-FLIP-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-08-13 16:39 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cfn-flip",
"purl": "pkg:brew/cfn-flip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cfn-flip-CVE-2026-7246",
"modified": "2026-08-13T16:39:06Z",
"published": "2026-08-13T16:39:06Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CFRIPPER-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-10-02 08:50 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cfripper",
"purl": "pkg:brew/cfripper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cfripper-CVE-2026-7246",
"modified": "2026-10-02T08:50:24Z",
"published": "2026-08-13T16:39:06Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CHECK-JSONSCHEMA-CV… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-09-24 09:23 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "check-jsonschema",
"purl": "pkg:brew/check-jsonschema"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.38.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-check-jsonschema-CVE-2026-7246",
"modified": "2026-09-24T09:23:19Z",
"published": "2026-08-13T16:39:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CHECKOV-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-09-20 12:11 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "checkov",
"purl": "pkg:brew/checkov"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-checkov-CVE-2026-7246",
"modified": "2026-09-20T12:11:43Z",
"published": "2026-08-13T16:39:32Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CINECLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-09-17 18:31 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cinecli",
"purl": "pkg:brew/cinecli"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.2"
},
{
"fixed": "0.1.2_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cinecli-CVE-2026-7246",
"modified": "2026-09-17T18:31:07Z",
"published": "2026-08-13T16:39:42Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CLOUDFORMATION-CLI-… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:40 – Updated: 2026-09-05 08:45 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cloudformation-cli",
"purl": "pkg:brew/cloudformation-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.39_13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cloudformation-cli-CVE-2026-7246",
"modified": "2026-09-05T08:45:58Z",
"published": "2026-08-13T16:40:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CLOUDSPLAINING-CVE-… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:40 – Updated: 2026-09-18 15:13 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cloudsplaining",
"purl": "pkg:brew/cloudsplaining"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cloudsplaining-CVE-2026-7246",
"modified": "2026-09-18T15:13:07Z",
"published": "2026-08-13T16:40:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-COBO-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:40 – Updated: 2026-09-17 18:21 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cobo-cli",
"purl": "pkg:brew/cobo-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.4"
},
{
"fixed": "0.1.7_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cobo-cli-CVE-2026-7246",
"modified": "2026-09-17T18:21:36Z",
"published": "2026-08-13T16:40:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CODECOV-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:40 – Updated: 2026-08-13 16:40 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.2.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "codecov-cli",
"purl": "pkg:brew/codecov-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.2.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.2.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-codecov-cli-CVE-2026-7246",
"modified": "2026-08-13T16:40:10Z",
"published": "2026-08-13T16:40:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CODELIMIT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:40 – Updated: 2026-08-13 16:40 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.8",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "codelimit",
"purl": "pkg:brew/codelimit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.8",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.8"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-codelimit-CVE-2026-7246",
"modified": "2026-08-13T16:40:10Z",
"published": "2026-08-13T16:40:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-COMPILEDB-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-17 19:02 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "compiledb",
"purl": "pkg:brew/compiledb"
},
"ranges": [
{
"events": [
{
"introduced": "0.10.1"
},
{
"fixed": "0.10.7_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-compiledb-CVE-2026-7246",
"modified": "2026-09-17T19:02:38Z",
"published": "2026-08-13T16:41:02Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CONDA-LOCK-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-17 18:12 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "conda-lock",
"purl": "pkg:brew/conda-lock"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "4.0.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-conda-lock-CVE-2026-7246",
"modified": "2026-09-17T18:12:38Z",
"published": "2026-08-13T16:41:05Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-COOKIECUTTER-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-10-02 08:49 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cookiecutter",
"purl": "pkg:brew/cookiecutter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.1_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cookiecutter-CVE-2026-7246",
"modified": "2026-10-02T08:49:37Z",
"published": "2026-08-13T16:41:06Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CRUFT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-05 08:46 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cruft",
"purl": "pkg:brew/cruft"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.0_14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cruft-CVE-2026-7246",
"modified": "2026-09-05T08:46:32Z",
"published": "2026-08-13T16:41:15Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-CYCODE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-08-13 16:42 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.8",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "cycode",
"purl": "pkg:brew/cycode"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.8",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.8"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-cycode-CVE-2026-7246",
"modified": "2026-08-13T16:42:07Z",
"published": "2026-08-13T16:42:07Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DARKER-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-09-17 19:55 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "darker",
"purl": "pkg:brew/darker"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-darker-CVE-2026-7246",
"modified": "2026-09-17T19:55:39Z",
"published": "2026-08-13T16:42:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DATASETTE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-09-12 08:50 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "datasette",
"purl": "pkg:brew/datasette"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.65.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-datasette-CVE-2026-7246",
"modified": "2026-09-12T08:50:44Z",
"published": "2026-08-13T16:42:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DJLINT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-09-17 18:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "djlint",
"purl": "pkg:brew/djlint"
},
"ranges": [
{
"events": [
{
"introduced": "1.35.2"
},
{
"fixed": "1.38.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-djlint-CVE-2026-7246",
"modified": "2026-09-17T18:52:53Z",
"published": "2026-08-13T16:42:58Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DNSGEN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:43 – Updated: 2026-10-02 08:50 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "dnsgen",
"purl": "pkg:brew/dnsgen"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.4"
},
{
"fixed": "1.0.4_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-dnsgen-CVE-2026-7246",
"modified": "2026-10-02T08:50:44Z",
"published": "2026-08-13T16:43:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DNSROBOCERT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:43 – Updated: 2026-09-30 18:46 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "dnsrobocert",
"purl": "pkg:brew/dnsrobocert"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.27.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-dnsrobocert-CVE-2026-7246",
"modified": "2026-09-30T18:46:17Z",
"published": "2026-08-13T16:43:20Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DOITLIVE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:43 – Updated: 2026-08-13 16:43 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "doitlive",
"purl": "pkg:brew/doitlive"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-doitlive-CVE-2026-7246",
"modified": "2026-08-13T16:43:22Z",
"published": "2026-08-13T16:43:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DOOIT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:43 – Updated: 2026-08-13 16:43 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "dooit",
"purl": "pkg:brew/dooit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.4_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-dooit-CVE-2026-7246",
"modified": "2026-08-13T16:43:22Z",
"published": "2026-08-13T16:43:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DSTACK-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:43 – Updated: 2026-08-29 08:47 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "dstack",
"purl": "pkg:brew/dstack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-dstack-CVE-2026-7246",
"modified": "2026-08-29T08:47:36Z",
"published": "2026-08-13T16:43:57Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DVC-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:44 – Updated: 2026-09-05 08:49 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "dvc",
"purl": "pkg:brew/dvc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.67.1_14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-dvc-CVE-2026-7246",
"modified": "2026-09-05T08:49:59Z",
"published": "2026-08-13T16:44:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-DVR-SCAN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:44 – Updated: 2026-08-13 16:44 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.2.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "dvr-scan",
"purl": "pkg:brew/dvr-scan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.2.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.2.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-dvr-scan-CVE-2026-7246",
"modified": "2026-08-13T16:44:48Z",
"published": "2026-08-13T16:44:48Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ECS-DEPLOY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:44 – Updated: 2026-10-02 09:55 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "ecs-deploy",
"purl": "pkg:brew/ecs-deploy"
},
"ranges": [
{
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.15.2_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-ecs-deploy-CVE-2026-7246",
"modified": "2026-10-02T09:55:38Z",
"published": "2026-08-13T16:44:52Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ESPHOME-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:45 – Updated: 2026-08-13 16:45 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.3",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "esphome",
"purl": "pkg:brew/esphome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.3",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.3"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-esphome-CVE-2026-7246",
"modified": "2026-08-13T16:45:08Z",
"published": "2026-08-13T16:45:08Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ESPTOOL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:45 – Updated: 2026-09-17 19:31 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "esptool",
"purl": "pkg:brew/esptool"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-esptool-CVE-2026-7246",
"modified": "2026-09-17T19:31:42Z",
"published": "2026-08-13T16:45:08Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-EULER-PY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:45 – Updated: 2026-08-13 16:45 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "euler-py",
"purl": "pkg:brew/euler-py"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-euler-py-CVE-2026-7246",
"modified": "2026-08-13T16:45:10Z",
"published": "2026-08-13T16:45:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-EVERNOTE-BACKUP-CVE… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:45 – Updated: 2026-08-13 16:45 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.8",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "evernote-backup",
"purl": "pkg:brew/evernote-backup"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.8",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.8"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-evernote-backup-CVE-2026-7246",
"modified": "2026-08-13T16:45:10Z",
"published": "2026-08-13T16:45:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FASTAPI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:46 – Updated: 2026-10-01 10:23 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "fastapi",
"purl": "pkg:brew/fastapi"
},
"ranges": [
{
"events": [
{
"introduced": "0.111.0"
},
{
"fixed": "0.136.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-fastapi-CVE-2026-7246",
"modified": "2026-10-01T10:23:41Z",
"published": "2026-08-13T16:46:30Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FASTMCP-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:46 – Updated: 2026-09-17 19:27 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "fastmcp",
"purl": "pkg:brew/fastmcp"
},
"ranges": [
{
"events": [
{
"introduced": "2.12.3"
},
{
"fixed": "3.2.4_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-fastmcp-CVE-2026-7246",
"modified": "2026-09-17T19:27:54Z",
"published": "2026-08-13T16:46:31Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FAVA-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:46 – Updated: 2026-10-06 17:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "fava",
"purl": "pkg:brew/fava"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.30.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-fava-CVE-2026-7246",
"modified": "2026-10-06T17:35:13Z",
"published": "2026-08-13T16:46:31Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FDROIDSERVER-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:46 – Updated: 2026-09-05 08:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "fdroidserver",
"purl": "pkg:brew/fdroidserver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.5_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-fdroidserver-CVE-2026-7246",
"modified": "2026-09-05T08:52:31Z",
"published": "2026-08-13T16:46:32Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FIONA-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:47 – Updated: 2026-08-13 16:47 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "fiona",
"purl": "pkg:brew/fiona"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-fiona-CVE-2026-7246",
"modified": "2026-08-13T16:47:26Z",
"published": "2026-08-13T16:47:26Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FLEXGET-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:47 – Updated: 2026-09-17 19:40 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "flexget",
"purl": "pkg:brew/flexget"
},
"ranges": [
{
"events": [
{
"introduced": "3.17.7"
},
{
"fixed": "3.19.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-flexget-CVE-2026-7246",
"modified": "2026-09-17T19:40:23Z",
"published": "2026-08-13T16:47:29Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FLINTROCK-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:47 – Updated: 2026-08-13 16:47 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.7",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "flintrock",
"purl": "pkg:brew/flintrock"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.7",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.7"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-flintrock-CVE-2026-7246",
"modified": "2026-08-13T16:47:29Z",
"published": "2026-08-13T16:47:29Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-FRED-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:48 – Updated: 2026-10-02 09:11 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "fred",
"purl": "pkg:brew/fred"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-fred-CVE-2026-7246",
"modified": "2026-10-02T09:11:33Z",
"published": "2026-08-13T16:48:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GAMDL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:49 – Updated: 2026-09-17 17:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "gamdl",
"purl": "pkg:brew/gamdl"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.1"
},
{
"fixed": "3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-gamdl-CVE-2026-7246",
"modified": "2026-09-17T17:52:28Z",
"published": "2026-08-13T16:49:04Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GDBGUI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:49 – Updated: 2026-08-13 16:49 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.2.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "gdbgui",
"purl": "pkg:brew/gdbgui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.2.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.2.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-gdbgui-CVE-2026-7246",
"modified": "2026-08-13T16:49:15Z",
"published": "2026-08-13T16:49:15Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GGSHIELD-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:50 – Updated: 2026-08-28 12:29 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "ggshield",
"purl": "pkg:brew/ggshield"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.53.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-ggshield-CVE-2026-7246",
"modified": "2026-08-28T12:29:45Z",
"published": "2026-08-13T16:50:00Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GITINGEST-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:51 – Updated: 2026-09-20 10:49 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "gitingest",
"purl": "pkg:brew/gitingest"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.1"
},
{
"fixed": "0.3.1_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-gitingest-CVE-2026-7246",
"modified": "2026-09-20T10:49:33Z",
"published": "2026-08-13T16:51:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GITLINT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:51 – Updated: 2026-08-13 16:51 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "gitlint",
"purl": "pkg:brew/gitlint"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.19.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-gitlint-CVE-2026-7246",
"modified": "2026-08-13T16:51:23Z",
"published": "2026-08-13T16:51:23Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GLANCES-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:51 – Updated: 2026-09-28 18:24 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "glances",
"purl": "pkg:brew/glances"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-glances-CVE-2026-7246",
"modified": "2026-09-28T18:24:14Z",
"published": "2026-08-13T16:51:23Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GNURADIO-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:52 – Updated: 2026-08-13 16:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "gnuradio",
"purl": "pkg:brew/gnuradio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-gnuradio-CVE-2026-7246",
"modified": "2026-08-13T16:52:30Z",
"published": "2026-08-13T16:52:30Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GOOLABS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:53 – Updated: 2026-10-02 08:53 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "goolabs",
"purl": "pkg:brew/goolabs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0_18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-goolabs-CVE-2026-7246",
"modified": "2026-10-02T08:53:25Z",
"published": "2026-08-13T16:53:15Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GPTLINE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:54 – Updated: 2026-08-30 09:03 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "gptline",
"purl": "pkg:brew/gptline"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.8_22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-gptline-CVE-2026-7246",
"modified": "2026-08-30T09:03:17Z",
"published": "2026-08-13T16:54:46Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GPTME-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:54 – Updated: 2026-09-20 10:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "gptme",
"purl": "pkg:brew/gptme"
},
"ranges": [
{
"events": [
{
"introduced": "0.19.1"
},
{
"fixed": "0.31.0_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-gptme-CVE-2026-7246",
"modified": "2026-09-20T10:52:06Z",
"published": "2026-08-13T16:54:46Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-GRIP-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:55 – Updated: 2026-10-04 11:05 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "grip",
"purl": "pkg:brew/grip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.2_21"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-grip-CVE-2026-7246",
"modified": "2026-10-04T11:05:06Z",
"published": "2026-08-13T16:55:20Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-HAPLESS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:55 – Updated: 2026-09-17 19:55 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "hapless",
"purl": "pkg:brew/hapless"
},
"ranges": [
{
"events": [
{
"introduced": "0.14.0"
},
{
"fixed": "0.15.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-hapless-CVE-2026-7246",
"modified": "2026-09-17T19:55:52Z",
"published": "2026-08-13T16:55:33Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-HARLEQUIN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:55 – Updated: 2026-09-17 17:38 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "harlequin",
"purl": "pkg:brew/harlequin"
},
"ranges": [
{
"events": [
{
"introduced": "1.25.2"
},
{
"fixed": "2.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-harlequin-CVE-2026-7246",
"modified": "2026-09-17T17:38:02Z",
"published": "2026-08-13T16:55:40Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-HATCH-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:56 – Updated: 2026-09-10 19:25 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "hatch",
"purl": "pkg:brew/hatch"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-hatch-CVE-2026-7246",
"modified": "2026-09-10T19:25:29Z",
"published": "2026-08-13T16:56:21Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-HF-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:56 – Updated: 2026-09-17 18:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "hf",
"purl": "pkg:brew/hf"
},
"ranges": [
{
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-hf-CVE-2026-7246",
"modified": "2026-09-17T18:52:10Z",
"published": "2026-08-13T16:56:26Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-HOMEASSISTANT-CLI-C… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:56 – Updated: 2026-10-04 10:39 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "homeassistant-cli",
"purl": "pkg:brew/homeassistant-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-homeassistant-cli-CVE-2026-7246",
"modified": "2026-10-04T10:39:46Z",
"published": "2026-08-13T16:56:27Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-HOWDOI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:56 – Updated: 2026-09-30 21:09 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "howdoi",
"purl": "pkg:brew/howdoi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.20_22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-howdoi-CVE-2026-7246",
"modified": "2026-09-30T21:09:20Z",
"published": "2026-08-13T16:56:27Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-HTTP-PROMPT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:56 – Updated: 2026-10-04 20:11 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "http-prompt",
"purl": "pkg:brew/http-prompt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0_20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-http-prompt-CVE-2026-7246",
"modified": "2026-10-04T20:11:20Z",
"published": "2026-08-13T16:56:28Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ICLOUDPD-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:59 – Updated: 2026-08-13 16:59 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "icloudpd",
"purl": "pkg:brew/icloudpd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-icloudpd-CVE-2026-7246",
"modified": "2026-08-13T16:59:03Z",
"published": "2026-08-13T16:59:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-IREDIS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:00 – Updated: 2026-09-17 17:45 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "iredis",
"purl": "pkg:brew/iredis"
},
"ranges": [
{
"events": [
{
"introduced": "1.9.4"
},
{
"fixed": "1.16.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-iredis-CVE-2026-7246",
"modified": "2026-09-17T17:45:16Z",
"published": "2026-08-13T17:00:03Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-JIRATUI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:00 – Updated: 2026-09-17 18:51 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "jiratui",
"purl": "pkg:brew/jiratui"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.7.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-jiratui-CVE-2026-7246",
"modified": "2026-09-17T18:51:24Z",
"published": "2026-08-13T17:00:58Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-KASKADE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-09-17 19:28 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "kaskade",
"purl": "pkg:brew/kaskade"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.3"
},
{
"fixed": "4.0.7_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-kaskade-CVE-2026-7246",
"modified": "2026-09-17T19:28:28Z",
"published": "2026-08-13T17:01:21Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-KEEPER-COMMANDER-CV… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-10-04 11:07 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "keeper-commander",
"purl": "pkg:brew/keeper-commander"
},
"ranges": [
{
"events": [
{
"introduced": "17.0.20"
},
{
"fixed": "17.2.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-keeper-commander-CVE-2026-7246",
"modified": "2026-10-04T11:07:28Z",
"published": "2026-08-13T17:01:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-KHAL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-08-13 17:01 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "khal",
"purl": "pkg:brew/khal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-khal-CVE-2026-7246",
"modified": "2026-08-13T17:01:22Z",
"published": "2026-08-13T17:01:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-KIMI-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-09-17 20:03 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "kimi-cli",
"purl": "pkg:brew/kimi-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0.40"
},
{
"fixed": "1.39.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-kimi-cli-CVE-2026-7246",
"modified": "2026-09-17T20:03:16Z",
"published": "2026-08-13T17:01:40Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LANGGRAPH-CLI-CVE-2… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:02 – Updated: 2026-09-20 10:53 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "langgraph-cli",
"purl": "pkg:brew/langgraph-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.52"
},
{
"fixed": "0.4.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-langgraph-cli-CVE-2026-7246",
"modified": "2026-09-20T10:53:47Z",
"published": "2026-08-13T17:02:14Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LEGIT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:02 – Updated: 2026-09-05 09:11 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "legit",
"purl": "pkg:brew/legit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.0.post0_14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-legit-CVE-2026-7246",
"modified": "2026-09-05T09:11:40Z",
"published": "2026-08-13T17:02:43Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LEXICON-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:02 – Updated: 2026-09-20 11:32 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "lexicon",
"purl": "pkg:brew/lexicon"
},
"ranges": [
{
"events": [
{
"introduced": "3.11.2"
},
{
"fixed": "3.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-lexicon-CVE-2026-7246",
"modified": "2026-09-20T11:32:16Z",
"published": "2026-08-13T17:02:43Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LITECLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:02 – Updated: 2026-09-10 19:41 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "litecli",
"purl": "pkg:brew/litecli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-litecli-CVE-2026-7246",
"modified": "2026-09-10T19:41:45Z",
"published": "2026-08-13T17:02:55Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LITERATE-GIT-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:02 – Updated: 2026-09-17 19:14 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "literate-git",
"purl": "pkg:brew/literate-git"
},
"ranges": [
{
"events": [
{
"introduced": "0.4.6"
},
{
"fixed": "0.5.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-literate-git-CVE-2026-7246",
"modified": "2026-09-17T19:14:18Z",
"published": "2026-08-13T17:02:55Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LLM-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:03 – Updated: 2026-09-04 09:19 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "llm",
"purl": "pkg:brew/llm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.32"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-llm-CVE-2026-7246",
"modified": "2026-09-04T09:19:21Z",
"published": "2026-08-13T17:03:00Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LOCALSTACK-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:03 – Updated: 2026-08-13 17:03 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "localstack",
"purl": "pkg:brew/localstack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-localstack-CVE-2026-7246",
"modified": "2026-08-13T17:03:02Z",
"published": "2026-08-13T17:03:02Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-LOCUST-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:03 – Updated: 2026-09-08 19:02 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "locust",
"purl": "pkg:brew/locust"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.46.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-locust-CVE-2026-7246",
"modified": "2026-09-08T19:02:14Z",
"published": "2026-08-13T17:03:02Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MAGIC-WORMHOLE-CVE-… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:10 – Updated: 2026-09-24 09:20 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "magic-wormhole",
"purl": "pkg:brew/magic-wormhole"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.2"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-magic-wormhole-CVE-2026-7246",
"modified": "2026-09-24T09:20:57Z",
"published": "2026-08-13T17:10:52Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MAIGRET-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:11 – Updated: 2026-09-20 11:53 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "maigret",
"purl": "pkg:brew/maigret"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-maigret-CVE-2026-7246",
"modified": "2026-09-20T11:53:18Z",
"published": "2026-08-13T17:11:30Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MAIL-DEDUPLICATE-CV… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:11 – Updated: 2026-09-17 18:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mail-deduplicate",
"purl": "pkg:brew/mail-deduplicate"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.1.2_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mail-deduplicate-CVE-2026-7246",
"modified": "2026-09-17T18:52:19Z",
"published": "2026-08-13T17:11:30Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MANIM-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:11 – Updated: 2026-08-13 17:11 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "manim",
"purl": "pkg:brew/manim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-manim-CVE-2026-7246",
"modified": "2026-08-13T17:11:34Z",
"published": "2026-08-13T17:11:34Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MCP-ATLASSIAN-CVE-2… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-30 20:03 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-atlassian",
"purl": "pkg:brew/mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0.11.9"
},
{
"fixed": "0.21.1_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mcp-atlassian-CVE-2026-7246",
"modified": "2026-09-30T20:03:26Z",
"published": "2026-08-13T17:13:13Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MCP-GOOGLE-SHEETS-C… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-30 18:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-google-sheets",
"purl": "pkg:brew/mcp-google-sheets"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.1"
},
{
"fixed": "0.6.1_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mcp-google-sheets-CVE-2026-7246",
"modified": "2026-09-30T18:52:01Z",
"published": "2026-08-13T17:13:13Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MCP-PROXY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-30 20:11 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcp-proxy",
"purl": "pkg:brew/mcp-proxy"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.2"
},
{
"fixed": "0.11.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mcp-proxy-CVE-2026-7246",
"modified": "2026-09-30T20:11:31Z",
"published": "2026-08-13T17:13:13Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MCPM-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-20 12:14 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mcpm",
"purl": "pkg:brew/mcpm"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.2"
},
{
"fixed": "2.14.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mcpm-CVE-2026-7246",
"modified": "2026-09-20T12:14:15Z",
"published": "2026-08-13T17:13:14Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-META-PACKAGE-MANAGE… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:13 – Updated: 2026-09-22 10:19 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "meta-package-manager",
"purl": "pkg:brew/meta-package-manager"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-meta-package-manager-CVE-2026-7246",
"modified": "2026-09-22T10:19:10Z",
"published": "2026-08-13T17:13:21Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MISTRAL-VIBE-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-09-17 19:14 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.3",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mistral-vibe",
"purl": "pkg:brew/mistral-vibe"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.1"
},
{
"fixed": "2.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.3",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.3"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mistral-vibe-CVE-2026-7246",
"modified": "2026-09-17T19:14:51Z",
"published": "2026-08-13T17:14:16Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MKDOCS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-08-13 17:14 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mkdocs",
"purl": "pkg:brew/mkdocs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mkdocs-CVE-2026-7246",
"modified": "2026-08-13T17:14:17Z",
"published": "2026-08-13T17:14:17Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MKDOCS-MATERIAL-CVE… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-10-04 10:43 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mkdocs-material",
"purl": "pkg:brew/mkdocs-material"
},
"ranges": [
{
"events": [
{
"introduced": "9.5.41"
},
{
"fixed": "9.7.6_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mkdocs-material-CVE-2026-7246",
"modified": "2026-10-04T10:43:31Z",
"published": "2026-08-13T17:14:17Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MLX-LM-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-09-17 20:04 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mlx-lm",
"purl": "pkg:brew/mlx-lm"
},
"ranges": [
{
"events": [
{
"introduced": "0.30.0"
},
{
"fixed": "0.31.3_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mlx-lm-CVE-2026-7246",
"modified": "2026-09-17T20:04:34Z",
"published": "2026-08-13T17:14:17Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MOLECULE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-09-25 08:56 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "molecule",
"purl": "pkg:brew/molecule"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-molecule-CVE-2026-7246",
"modified": "2026-09-25T08:56:05Z",
"published": "2026-08-13T17:14:18Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MOTO-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-10-04 13:01 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "moto",
"purl": "pkg:brew/moto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.2_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-moto-CVE-2026-7246",
"modified": "2026-10-04T13:01:00Z",
"published": "2026-08-13T17:14:37Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MYCLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:16 – Updated: 2026-09-04 09:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mycli",
"purl": "pkg:brew/mycli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.13.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mycli-CVE-2026-7246",
"modified": "2026-09-04T09:35:11Z",
"published": "2026-08-13T17:16:44Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-MYSQL-TO-SQLITE3-CV… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:16 – Updated: 2026-09-22 10:04 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "mysql-to-sqlite3",
"purl": "pkg:brew/mysql-to-sqlite3"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.5"
},
{
"fixed": "2.6.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-mysql-to-sqlite3-CVE-2026-7246",
"modified": "2026-09-22T10:04:08Z",
"published": "2026-08-13T17:16:54Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-NAME-THAT-HASH-CVE-… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:16 – Updated: 2026-08-13 17:16 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "name-that-hash",
"purl": "pkg:brew/name-that-hash"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.0_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-name-that-hash-CVE-2026-7246",
"modified": "2026-08-13T17:16:56Z",
"published": "2026-08-13T17:16:56Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-NOTIFIERS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:18 – Updated: 2026-10-04 12:21 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "notifiers",
"purl": "pkg:brew/notifiers"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.6_6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-notifiers-CVE-2026-7246",
"modified": "2026-10-04T12:21:37Z",
"published": "2026-08-13T17:18:40Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-OCI-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:19 – Updated: 2026-08-13 17:19 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "oci-cli",
"purl": "pkg:brew/oci-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.90.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-oci-cli-CVE-2026-7246",
"modified": "2026-08-13T17:19:22Z",
"published": "2026-08-13T17:19:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-OKTA-AWSCLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:19 – Updated: 2026-09-18 17:08 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "okta-awscli",
"purl": "pkg:brew/okta-awscli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.5_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-okta-awscli-CVE-2026-7246",
"modified": "2026-09-18T17:08:42Z",
"published": "2026-08-13T17:19:23Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-OMNARA-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:19 – Updated: 2026-08-13 17:19 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "omnara",
"purl": "pkg:brew/omnara"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-omnara-CVE-2026-7246",
"modified": "2026-08-13T17:19:23Z",
"published": "2026-08-13T17:19:23Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ONLYKEY-AGENT-CVE-2… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:21 – Updated: 2026-10-04 12:44 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "onlykey-agent",
"purl": "pkg:brew/onlykey-agent"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.14"
},
{
"fixed": "1.1.15_13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-onlykey-agent-CVE-2026-7246",
"modified": "2026-10-04T12:44:42Z",
"published": "2026-08-13T17:21:25Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-OTERM-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:24 – Updated: 2026-09-17 18:44 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "oterm",
"purl": "pkg:brew/oterm"
},
"ranges": [
{
"events": [
{
"introduced": "0.13.1"
},
{
"fixed": "0.15.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-oterm-CVE-2026-7246",
"modified": "2026-09-17T18:44:04Z",
"published": "2026-08-13T17:24:19Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-OTTERDOG-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:24 – Updated: 2026-09-17 18:06 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "otterdog",
"purl": "pkg:brew/otterdog"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.1"
},
{
"fixed": "1.3.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-otterdog-CVE-2026-7246",
"modified": "2026-09-17T18:06:15Z",
"published": "2026-08-13T17:24:19Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-OVERTUREMAPS-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:24 – Updated: 2026-09-17 19:32 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "overturemaps",
"purl": "pkg:brew/overturemaps"
},
"ranges": [
{
"events": [
{
"introduced": "0.20.0"
},
{
"fixed": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-overturemaps-CVE-2026-7246",
"modified": "2026-09-17T19:32:05Z",
"published": "2026-08-13T17:24:19Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PAPIS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:25 – Updated: 2026-09-17 19:57 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "papis",
"purl": "pkg:brew/papis"
},
"ranges": [
{
"events": [
{
"introduced": "0.14.1"
},
{
"fixed": "0.15.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-papis-CVE-2026-7246",
"modified": "2026-09-17T19:57:48Z",
"published": "2026-08-13T17:25:32Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PGCLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:26 – Updated: 2026-09-22 08:55 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pgcli",
"purl": "pkg:brew/pgcli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pgcli-CVE-2026-7246",
"modified": "2026-09-22T08:55:46Z",
"published": "2026-08-13T17:26:06Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PIECES-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-20 10:59 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pieces-cli",
"purl": "pkg:brew/pieces-cli"
},
"ranges": [
{
"events": [
{
"introduced": "1.15.1"
},
{
"fixed": "1.20.1_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pieces-cli-CVE-2026-7246",
"modified": "2026-09-20T10:59:59Z",
"published": "2026-08-13T17:28:18Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PIP-TOOLS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-08-13 17:28 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pip-tools",
"purl": "pkg:brew/pip-tools"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pip-tools-CVE-2026-7246",
"modified": "2026-08-13T17:28:21Z",
"published": "2026-08-13T17:28:21Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PIPGRIP-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-08-13 17:28 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pipgrip",
"purl": "pkg:brew/pipgrip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pipgrip-CVE-2026-7246",
"modified": "2026-08-13T17:28:22Z",
"published": "2026-08-13T17:28:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PIPX-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-17 18:41 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pipx",
"purl": "pkg:brew/pipx"
},
"ranges": [
{
"events": [
{
"introduced": "0.14.0.0"
},
{
"fixed": "1.11.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pipx-CVE-2026-7246",
"modified": "2026-09-17T18:41:40Z",
"published": "2026-08-13T17:28:22Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PLATFORMIO-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-10 00:53 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "platformio",
"purl": "pkg:brew/platformio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.19_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-platformio-CVE-2026-7246",
"modified": "2026-09-10T00:53:31Z",
"published": "2026-08-13T17:28:24Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-POCKET-TTS-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-17 17:39 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pocket-tts",
"purl": "pkg:brew/pocket-tts"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.2"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pocket-tts-CVE-2026-7246",
"modified": "2026-09-17T17:39:07Z",
"published": "2026-08-13T17:28:25Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PODCAST-ARCHIVER-CV… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-10-03 08:55 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "podcast-archiver",
"purl": "pkg:brew/podcast-archiver"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.1"
},
{
"fixed": "2.3.5_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-podcast-archiver-CVE-2026-7246",
"modified": "2026-10-03T08:55:25Z",
"published": "2026-08-13T17:28:25Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-POLICY_SENTRY-CVE-2… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-18 17:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "policy_sentry",
"purl": "pkg:brew/policy_sentry"
},
"ranges": [
{
"events": [
{
"introduced": "0.12.10"
},
{
"fixed": "0.15.2_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-policy_sentry-CVE-2026-7246",
"modified": "2026-09-18T17:35:31Z",
"published": "2026-08-13T17:28:26Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-POSTING-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-20 11:01 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "posting",
"purl": "pkg:brew/posting"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.10.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-posting-CVE-2026-7246",
"modified": "2026-09-20T11:01:55Z",
"published": "2026-08-13T17:28:48Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PROWLER-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:29 – Updated: 2026-08-30 09:42 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "prowler",
"purl": "pkg:brew/prowler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.37.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-prowler-CVE-2026-7246",
"modified": "2026-08-30T09:42:27Z",
"published": "2026-08-13T17:29:23Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PULP-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:29 – Updated: 2026-09-17 18:52 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pulp-cli",
"purl": "pkg:brew/pulp-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0.35.0"
},
{
"fixed": "0.39.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pulp-cli-CVE-2026-7246",
"modified": "2026-09-17T18:52:47Z",
"published": "2026-08-13T17:29:24Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PYTHON-LSP-SERVER-C… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:29 – Updated: 2026-09-17 20:04 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "python-lsp-server",
"purl": "pkg:brew/python-lsp-server"
},
"ranges": [
{
"events": [
{
"introduced": "1.11.0"
},
{
"fixed": "1.14.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-python-lsp-server-CVE-2026-7246",
"modified": "2026-09-17T20:04:46Z",
"published": "2026-08-13T17:29:47Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-PYWHAT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:29 – Updated: 2026-08-13 17:29 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@7.1.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "pywhat",
"purl": "pkg:brew/pywhat"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@7.1.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "7.1.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-pywhat-CVE-2026-7246",
"modified": "2026-08-13T17:29:59Z",
"published": "2026-08-13T17:29:59Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-RASTERIO-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-10-02 09:04 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "rasterio",
"purl": "pkg:brew/rasterio"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.3"
},
{
"fixed": "1.5.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-rasterio-CVE-2026-7246",
"modified": "2026-10-02T09:04:01Z",
"published": "2026-08-13T17:32:08Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-RAWDOG-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-10-05 10:00 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "rawdog",
"purl": "pkg:brew/rawdog"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.5"
},
{
"fixed": "0.1.6_24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-rawdog-CVE-2026-7246",
"modified": "2026-10-05T10:00:06Z",
"published": "2026-08-13T17:32:08Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-RECON-NG-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-08-13 17:32 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.3.1",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "recon-ng",
"purl": "pkg:brew/recon-ng"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.3.1",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.3.1"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-recon-ng-CVE-2026-7246",
"modified": "2026-08-13T17:32:25Z",
"published": "2026-08-13T17:32:25Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-REGIPY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-09-28 18:04 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "regipy",
"purl": "pkg:brew/regipy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-regipy-CVE-2026-7246",
"modified": "2026-09-28T18:04:31Z",
"published": "2026-08-13T17:32:30Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-REUSE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-09-17 18:24 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "reuse",
"purl": "pkg:brew/reuse"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.2"
},
{
"fixed": "6.2.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-reuse-CVE-2026-7246",
"modified": "2026-09-17T18:24:02Z",
"published": "2026-08-13T17:32:31Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-RICH-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-10-04 12:27 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "rich-cli",
"purl": "pkg:brew/rich-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-rich-cli-CVE-2026-7246",
"modified": "2026-10-04T12:27:20Z",
"published": "2026-08-13T17:32:31Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ROBOT-FRAMEWORK-CVE… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-09-16 10:17 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "robot-framework",
"purl": "pkg:brew/robot-framework"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.2_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-robot-framework-CVE-2026-7246",
"modified": "2026-09-16T10:17:18Z",
"published": "2026-08-13T17:32:32Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SAFETY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:33 – Updated: 2026-09-17 17:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "safety",
"purl": "pkg:brew/safety"
},
"ranges": [
{
"events": [
{
"introduced": "3.2.4"
},
{
"fixed": "3.7.0_11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-safety-CVE-2026-7246",
"modified": "2026-09-17T17:35:56Z",
"published": "2026-08-13T17:33:32Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SAIL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:33 – Updated: 2026-08-13 17:33 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.7",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sail",
"purl": "pkg:brew/sail"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.7",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.7"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sail-CVE-2026-7246",
"modified": "2026-08-13T17:33:32Z",
"published": "2026-08-13T17:33:32Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SCEPTRE-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-10-04 12:04 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sceptre",
"purl": "pkg:brew/sceptre"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.7.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sceptre-CVE-2026-7246",
"modified": "2026-10-04T12:04:48Z",
"published": "2026-08-13T17:34:18Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SCHEMATHESIS-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-09-08 19:54 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "schemathesis",
"purl": "pkg:brew/schemathesis"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.24.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-schemathesis-CVE-2026-7246",
"modified": "2026-09-08T19:54:21Z",
"published": "2026-08-13T17:34:18Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SEARCH-THAT-HASH-CV… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-08-13 17:34 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@7.1.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "search-that-hash",
"purl": "pkg:brew/search-that-hash"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@7.1.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "7.1.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-search-that-hash-CVE-2026-7246",
"modified": "2026-08-13T17:34:27Z",
"published": "2026-08-13T17:34:27Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SEMGREP-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-08-13 17:34 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "semgrep",
"purl": "pkg:brew/semgrep"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.172.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-semgrep-CVE-2026-7246",
"modified": "2026-08-13T17:34:27Z",
"published": "2026-08-13T17:34:27Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SGR-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-08-13 17:34 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@7.1.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sgr",
"purl": "pkg:brew/sgr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@7.1.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "7.1.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sgr-CVE-2026-7246",
"modified": "2026-08-13T17:34:36Z",
"published": "2026-08-13T17:34:36Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SHALLOW-BACKUP-CVE-… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-09-05 10:03 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "shallow-backup",
"purl": "pkg:brew/shallow-backup"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6_6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-shallow-backup-CVE-2026-7246",
"modified": "2026-09-05T10:03:38Z",
"published": "2026-08-13T17:34:37Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SHODAN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-10-04 12:05 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "shodan",
"purl": "pkg:brew/shodan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31.0_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-shodan-CVE-2026-7246",
"modified": "2026-10-04T12:05:51Z",
"published": "2026-08-13T17:34:39Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SHUB-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-10-04 12:25 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "shub",
"purl": "pkg:brew/shub"
},
"ranges": [
{
"events": [
{
"introduced": "2.14.5"
},
{
"fixed": "2.17.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-shub-CVE-2026-7246",
"modified": "2026-10-04T12:25:13Z",
"published": "2026-08-13T17:34:39Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SICKCHILL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-09-17 18:24 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sickchill",
"purl": "pkg:brew/sickchill"
},
"ranges": [
{
"events": [
{
"introduced": "2023.5.30"
},
{
"fixed": "2024.3.1_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sickchill-CVE-2026-7246",
"modified": "2026-09-17T18:24:58Z",
"published": "2026-08-13T17:34:39Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SIGMA-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-10-04 11:38 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sigma-cli",
"purl": "pkg:brew/sigma-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sigma-cli-CVE-2026-7246",
"modified": "2026-10-04T11:38:55Z",
"published": "2026-08-13T17:34:39Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SNAKEFMT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-08-13 17:34 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "snakefmt",
"purl": "pkg:brew/snakefmt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-snakefmt-CVE-2026-7246",
"modified": "2026-08-13T17:34:41Z",
"published": "2026-08-13T17:34:41Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SNAPCRAFT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:35 – Updated: 2026-09-22 10:36 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "snapcraft",
"purl": "pkg:brew/snapcraft"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-snapcraft-CVE-2026-7246",
"modified": "2026-09-22T10:36:03Z",
"published": "2026-08-13T17:35:45Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SNOWFLAKE-CLI-CVE-2… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:35 – Updated: 2026-08-13 17:35 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.8",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "snowflake-cli",
"purl": "pkg:brew/snowflake-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.8",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.8"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-snowflake-cli-CVE-2026-7246",
"modified": "2026-08-13T17:35:47Z",
"published": "2026-08-13T17:35:47Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SNYK-AGENT-SCAN-CVE… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:35 – Updated: 2026-09-17 18:07 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "snyk-agent-scan",
"purl": "pkg:brew/snyk-agent-scan"
},
"ranges": [
{
"events": [
{
"introduced": "0.4.3"
},
{
"fixed": "0.4.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-snyk-agent-scan-CVE-2026-7246",
"modified": "2026-09-17T18:07:01Z",
"published": "2026-08-13T17:35:48Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SPECIFY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:35 – Updated: 2026-09-17 18:43 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "specify",
"purl": "pkg:brew/specify"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.16"
},
{
"fixed": "0.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-specify-CVE-2026-7246",
"modified": "2026-09-17T18:43:01Z",
"published": "2026-08-13T17:35:56Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SQLFLUFF-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:40 – Updated: 2026-08-13 17:40 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sqlfluff",
"purl": "pkg:brew/sqlfluff"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sqlfluff-CVE-2026-7246",
"modified": "2026-08-13T17:40:10Z",
"published": "2026-08-13T17:40:10Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SQLITE-UTILS-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:40 – Updated: 2026-08-13 17:40 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sqlite-utils",
"purl": "pkg:brew/sqlite-utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sqlite-utils-CVE-2026-7246",
"modified": "2026-08-13T17:40:23Z",
"published": "2026-08-13T17:40:23Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SQLITE3-TO-MYSQL-CV… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:40 – Updated: 2026-09-22 08:59 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sqlite3-to-mysql",
"purl": "pkg:brew/sqlite3-to-mysql"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.3"
},
{
"fixed": "2.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sqlite3-to-mysql-CVE-2026-7246",
"modified": "2026-09-22T08:59:12Z",
"published": "2026-08-13T17:40:23Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-STRANDS-AGENTS-SOPS… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:41 – Updated: 2026-09-17 18:46 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "strands-agents-sops",
"purl": "pkg:brew/strands-agents-sops"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.1"
},
{
"fixed": "1.1.2_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-strands-agents-sops-CVE-2026-7246",
"modified": "2026-09-17T18:46:24Z",
"published": "2026-08-13T17:41:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-STREAMRIP-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:41 – Updated: 2026-10-04 21:02 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "streamrip",
"purl": "pkg:brew/streamrip"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.5"
},
{
"fixed": "2.1.0_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-streamrip-CVE-2026-7246",
"modified": "2026-10-04T21:02:59Z",
"published": "2026-08-13T17:41:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SUBLIMINAL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:41 – Updated: 2026-10-04 21:02 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "subliminal",
"purl": "pkg:brew/subliminal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-subliminal-CVE-2026-7246",
"modified": "2026-10-04T21:02:59Z",
"published": "2026-08-13T17:41:17Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-SYSAIDMIN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:42 – Updated: 2026-09-30 20:21 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "sysaidmin",
"purl": "pkg:brew/sysaidmin"
},
"ranges": [
{
"events": [
{
"introduced": "0.2.3"
},
{
"fixed": "0.2.5_14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-sysaidmin-CVE-2026-7246",
"modified": "2026-09-30T20:21:24Z",
"published": "2026-08-13T17:42:12Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TARTUFO-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:42 – Updated: 2026-09-17 19:42 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "tartufo",
"purl": "pkg:brew/tartufo"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "6.0.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-tartufo-CVE-2026-7246",
"modified": "2026-09-17T19:42:35Z",
"published": "2026-08-13T17:42:18Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-THEHARVESTER-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:43 – Updated: 2026-09-18 19:03 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "theharvester",
"purl": "pkg:brew/theharvester"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.11.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-theharvester-CVE-2026-7246",
"modified": "2026-09-18T19:03:29Z",
"published": "2026-08-13T17:43:26Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TMT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-09-17 18:05 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "tmt",
"purl": "pkg:brew/tmt"
},
"ranges": [
{
"events": [
{
"introduced": "1.33.0"
},
{
"fixed": "1.72.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-tmt-CVE-2026-7246",
"modified": "2026-09-17T18:05:15Z",
"published": "2026-08-13T17:44:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TODOMAN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-08-13 17:44 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "todoman",
"purl": "pkg:brew/todoman"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.7.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-todoman-CVE-2026-7246",
"modified": "2026-08-13T17:44:09Z",
"published": "2026-08-13T17:44:09Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TOOT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-09-18 19:07 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "toot",
"purl": "pkg:brew/toot"
},
"ranges": [
{
"events": [
{
"introduced": "0.40.0"
},
{
"fixed": "0.52.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-toot-CVE-2026-7246",
"modified": "2026-09-18T19:07:07Z",
"published": "2026-08-13T17:44:33Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TORRRA-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-09-17 17:31 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "torrra",
"purl": "pkg:brew/torrra"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.8"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-torrra-CVE-2026-7246",
"modified": "2026-09-17T17:31:36Z",
"published": "2026-08-13T17:44:50Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TRAILSCRAPER-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-08-13 17:44 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.8",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "trailscraper",
"purl": "pkg:brew/trailscraper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.8",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.8"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-trailscraper-CVE-2026-7246",
"modified": "2026-08-13T17:44:51Z",
"published": "2026-08-13T17:44:51Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TREZOR-AGENT-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-10-04 21:31 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "trezor-agent",
"purl": "pkg:brew/trezor-agent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.0_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-trezor-agent-CVE-2026-7246",
"modified": "2026-10-04T21:31:52Z",
"published": "2026-08-13T17:44:53Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TWARC-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-09-30 20:28 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "twarc",
"purl": "pkg:brew/twarc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.14.1_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-twarc-CVE-2026-7246",
"modified": "2026-09-30T20:28:12Z",
"published": "2026-08-13T17:44:53Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-TWTXT-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:44 – Updated: 2026-10-06 20:05 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "twtxt",
"purl": "pkg:brew/twtxt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.1_11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-twtxt-CVE-2026-7246",
"modified": "2026-10-06T20:05:32Z",
"published": "2026-08-13T17:44:53Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-UVICORN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:46 – Updated: 2026-09-16 10:41 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "uvicorn",
"purl": "pkg:brew/uvicorn"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-uvicorn-CVE-2026-7246",
"modified": "2026-09-16T10:41:43Z",
"published": "2026-08-13T17:46:24Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-VDIRSYNCER-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:46 – Updated: 2026-09-05 10:20 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "vdirsyncer",
"purl": "pkg:brew/vdirsyncer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.0_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-vdirsyncer-CVE-2026-7246",
"modified": "2026-09-05T10:20:54Z",
"published": "2026-08-13T17:46:47Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-VUNNEL-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:48 – Updated: 2026-09-25 09:32 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "vunnel",
"purl": "pkg:brew/vunnel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.63.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-vunnel-CVE-2026-7246",
"modified": "2026-09-25T09:32:57Z",
"published": "2026-08-13T17:48:57Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-WATSON-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:49 – Updated: 2026-10-04 23:28 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "watson",
"purl": "pkg:brew/watson"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0_12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-watson-CVE-2026-7246",
"modified": "2026-10-04T23:28:20Z",
"published": "2026-08-13T17:49:05Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-WAYBACKPY-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:49 – Updated: 2026-10-04 23:30 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "waybackpy",
"purl": "pkg:brew/waybackpy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.6_12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-waybackpy-CVE-2026-7246",
"modified": "2026-10-04T23:30:35Z",
"published": "2026-08-13T17:49:05Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-WEAVIATE-CLI-CVE-20… (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:49 – Updated: 2026-08-13 17:49 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.1.7",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "weaviate-cli",
"purl": "pkg:brew/weaviate-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.1.7",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.1.7"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-weaviate-cli-CVE-2026-7246",
"modified": "2026-08-13T17:49:06Z",
"published": "2026-08-13T17:49:06Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-YAMLFIX-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:54 – Updated: 2026-09-17 19:16 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "yamlfix",
"purl": "pkg:brew/yamlfix"
},
"ranges": [
{
"events": [
{
"introduced": "1.17.0"
},
{
"fixed": "1.19.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-yamlfix-CVE-2026-7246",
"modified": "2026-09-17T19:16:22Z",
"published": "2026-08-13T17:54:46Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-YKMAN-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:55 – Updated: 2026-08-13 17:55 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.4.2",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "ykman",
"purl": "pkg:brew/ykman"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.9.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.4.2",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.4.2"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-ykman-CVE-2026-7246",
"modified": "2026-08-13T17:55:05Z",
"published": "2026-08-13T17:55:05Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
BREW-ZABBIX-CLI-CVE-2026-7246 (PYSEC-2026-2132)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:55 – Updated: 2026-09-20 12:12 – Source website
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "click",
"resource_purl": "pkg:pypi/click@8.5.0",
"upstream_fixed_in": "8.3.3"
},
"package": {
"ecosystem": "Homebrew",
"name": "zabbix-cli",
"purl": "pkg:brew/zabbix-cli"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.6.3_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/click@8.5.0",
"name": "click",
"resource": "click",
"strategy": "registry",
"subject_version": "8.5.0"
}
]
},
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "BREW-zabbix-cli-CVE-2026-7246",
"modified": "2026-09-20T12:12:50Z",
"published": "2026-08-13T17:55:06Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"PYSEC-2026-2132",
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
]
}
PYSEC-2026-2132
Vulnerability from pysec - Published: 2026-04-30 14:16 - Updated: 2026-10-07 01:44
Withdrawn 2026-10-07
VLAI
Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Severity
7.2 (High)
Impacted products
| Name | purl | click | pkg:pypi/click |
|---|
Aliases
{
"affected": [
{
"ecosystem_specific": {},
"package": {
"ecosystem": "PyPI",
"name": "click",
"purl": "pkg:pypi/click"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1",
"0.2",
"0.3",
"0.4",
"0.5",
"0.5.1",
"0.6",
"0.7",
"1.0",
"1.1",
"2.0",
"2.1",
"2.2",
"2.3",
"2.4",
"2.5",
"2.6",
"3.0",
"3.1",
"3.2",
"3.3",
"4.0",
"4.1",
"5.0",
"5.1",
"6.0",
"6.1",
"6.2",
"6.3",
"6.4",
"6.5",
"6.6",
"6.7",
"6.7.dev0",
"7.0",
"7.1",
"7.1.1",
"7.1.2",
"8.0.0",
"8.0.0a1",
"8.0.0rc1",
"8.0.1",
"8.0.2",
"8.0.3",
"8.0.4",
"8.1.0",
"8.1.1",
"8.1.2",
"8.1.3",
"8.1.4",
"8.1.5",
"8.1.6",
"8.1.7",
"8.1.8",
"8.2.0",
"8.2.1",
"8.2.2",
"8.3.0",
"8.3.1",
"8.3.2"
]
}
],
"aliases": [
"CVE-2026-7246",
"GHSA-47fr-3ffg-hgmw"
],
"details": "Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.",
"id": "PYSEC-2026-2132",
"modified": "2026-10-07T01:44:46Z",
"published": "2026-04-30T14:16:36.433Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-7246"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24761"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464121"
},
{
"type": "FIX",
"url": "https://github.com/pallets/click/releases/tag/8.3.3"
},
{
"type": "EVIDENCE",
"url": "https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"withdrawn": "2026-10-07T01:44:46Z"
}