Skip to content
OpenAdvisories
Medium ALAS2023-2026-1854 1 CVE

Moderate: python-click security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7246: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 python3-click 0:7.1.2-5.amzn2023.0.3

Vulnerabilities 1

  • High 7.2
    CVE-2026-7246

    [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

    This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vul…

    Pallets Click Click python-click python-click Debian Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-7246.html