Security readout for executives and security teams
Plain-English summary
This CVE is disputed by the Pallets Click project, which says the record was assigned improperly and is not a valid vulnerability. The original report alleges command injection through attacker-controlled filenames passed to click.edit(). Because the supplied evidence conflicts, organizations should investigate actual application usage rather than assume all Click installations are vulnerable.
Executive priority
Treat this as a targeted validation task, not an emergency incident. Prioritize systems where untrusted users can influence filenames used by click.edit(), especially privileged administrative tooling. Broader remediation urgency should remain conditional until Pallets, Red Hat, or the CVE record provides consistent affected-version and fix information.
Technical view
The original claim covers Click 8.3.2 and earlier and alleges OS command injection through unsanitized filenames in click.edit(). The supplied CVSS 3.1 score is 7.2, but its local, high-complexity, high-privilege, user-interaction assumptions conflict with the description of an unprivileged attacker. The record also defaults the listed product to unaffected, reinforcing uncertainty.
Likely exposure
Potential exposure is limited to applications that invoke click.edit() and allow an untrusted party to influence its filename or related editor handling. Installing Click alone does not establish exposure. The bundle's affected-version data is inconsistent and defaults the product to unaffected, so dependency and code-path review is required.
Exploitation context
The bundle provides no evidence of active exploitation, and the CVE is not listed as KEV. The alleged attack requires a vulnerable application path and attacker influence over a filename; the supplied CVSS vector additionally assumes local access, high privileges, high complexity, and user interaction. These prerequisites remain disputed.
Researcher notes
The central issue is record validity. Pallets disputes the CVE, while the preserved allegation, CVSS prerequisites, and affected-product status are internally inconsistent. The bundle references Click 8.3.3 and Red Hat errata, but does not state that they fix this allegation. Reproduction claims should be evaluated without assuming the CVE's affected range is authoritative.
Mitigation direction
- Inventory Click versions and identify every application path calling click.edit().
- Prevent untrusted users or data from controlling filenames passed to click.edit().
- Restrict local access and privileges around applications invoking external editors.
- Review current Pallets and Red Hat guidance before selecting an upgrade or backport.
- Do not treat version 8.3.3 as a confirmed security fix from this bundle alone.
Validation and detection
- Confirm whether deployed applications import or invoke click.edit().
- Trace filename values to determine whether untrusted input can reach click.edit().
- Review editor configuration and process boundaries for unsafe filename interpretation.
- Compare deployed packages with current Pallets and Red Hat advisories.
- Document whether the disputed prerequisites are reachable in each environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-7246 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H0.66CISA-ADPCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H0.66redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-30T14:00:58.850Z: Reported to Red Hat.
- 2026-04-30T13:16:44.050Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pallets/click/releases/tag/8.3.3CVE reference, PSF
- https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmwCVE reference, PSF
- https://access.redhat.com/security/cve/CVE-2026-7246CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2464121CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24762CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24761CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.