Description
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pallets Click | Click | < 8.3.3 | 8.3.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-click | 8.3.3-1 | — |
| Debian 13 | python-click | No fix yet | — |
| Debian 12 | python-click | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.12-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.12-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.29-2.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | 2.6.14-3.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-6.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260422-3.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.9-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-pillow | 12.2.0-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-click | 8.2.1-160000.3.1 | SUSE-SU-2026:22321-1 |
| SLES 16.0 | python-click | 8.2.1-160000.3.1 | SUSE-SU-2026:22321-1 |
| SLE Micro 6.2 | python-click | 8.2.1-160000.3.1 | SUSE-SU-2026:22254-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-click | 8.3.3-2.1 | openSUSE-SU-2026:10760-1 |
| openSUSE Leap 16.0 | python-click | 8.2.1-160000.3.1 | openSUSE-SU-2026:21017-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-click | 7.1.2-5.amzn2023.0.3 | ALAS2023-2026-1854 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-click | 8.1.7-3 | — |
Advisories 8
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:24761 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24762 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2026:22321-1 Security update for python-click SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21017-1 Security update for python-click SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22254-1 Security update for python-click SUSE / openSUSE Security Updates · Jun 30, 2026
- ALAS2023-2026-1854 Moderate: python-click security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- openSUSE-SU-2026:10760-1 python311-click-8.3.3-2.1 on GA media SUSE / openSUSE Security Updates · May 13, 2026