On Fri Aug 21, 2026 at 6:32 PM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:

From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix for CVE-2026-7246 as referenced
in [2], using the upstream commit identified in [1].

The backport also adapts editor regression tests from the upstream
test and documentation follow-up identified in [3]. This follow-up
does not contain an additional production security fix.

[1] https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494ebee4aef8f42
[2] https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
[3] https://github.com/pallets/click/commit/b55294797ef32e22eb41e7d9657edb8faefa4976

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
.../python/python3-click/CVE-2026-7246.patch | 245 ++++++++++++++++++
.../python/python3-click_8.1.7.bb | 5 +-
2 files changed, 249 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch

diff --git a/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch
new file mode 100644
index 0000000000..47ee1a551f
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch
@@ -0,0 +1,245 @@
+From cb30f575b1a251e8698909bca2a443d41dad1824 Mon Sep 17 00:00:00 2001
+From: Kevin Deldycke <kevin@deldycke.com>
+Date: Wed, 4 Mar 2026 14:51:58 +0400
+Subject: [PATCH] Document and fix command string sanitizing with `shlex.split`
+
+Removes last use of `shell=True` use for command invokation for defense-in-depth.
+Refs: #1026, #1477 and #2775
+
+CVE: CVE-2026-7246
+Upstream-Status: Backport [https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494ebee4aef8f42]
+
+Backport Changes:
+- Click 8.1.7 uses Editor.edit_file(filename), not the newer
+ Editor.edit_files(filenames) API. Apply the argv-list change
+ to one filename without adding the multi-file API.
+- Adapt editor tests from b96c2601 and follow-up b5529479 to
Hello,

This commit has both b96c2601 and b5529479 squashed. Please keep
upstream backport patches split.

Can you send a v2 with as the CVE fix (b96c2601) and its followup
(b5529479)?

Thanks!

--
Yoann Congal
Smile ECS

Hi Yoann,

While preparing v2, I noticed that NVD now marks CVE-2026-7246 as disputed and states that the Pallets Click project does not consider it a valid vulnerability:

https://nvd.nist.gov/vuln/detail/CVE-2026-7246

However, the published advisory identifies upstream commit b96c2601 as the fix:

https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw

Upstream describes the removal of shell=True as defense-in-depth, so I wanted to confirm the preferred handling. Should I replace the backport patches with a status entry such as:

CVE_STATUS[CVE-2026-7246] = "disputed: Pallets Click does not consider this a valid vulnerability"

Or should I continue with the split v2 backport patches as hardening?

Thanks,
Darsh