Re: [scarthgap][PATCH] python3-click: fix CVE-2026-7246

["Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" <dkelaiya@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 3782 bytes --]

On Mon, Sep 7, 2026 at 02:56 PM, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:

> 
> On Sun, Sep 6, 2026 at 04:46 AM, Yoann Congal wrote:
> 
>> On Fri Aug 21, 2026 at 6:32 PM CEST, Darsh Kelaiya -X (dkelaiya - E
>> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>> 
>>> From: Darsh Kelaiya <dkelaiya@cisco.com>
>>> 
>>> This patch applies the upstream fix for CVE-2026-7246 as referenced
>>> in [2], using the upstream commit identified in [1].
>>> 
>>> The backport also adapts editor regression tests from the upstream
>>> test and documentation follow-up identified in [3]. This follow-up
>>> does not contain an additional production security fix.
>>> 
>>> [1] https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494ebee4aef8f42
>>> 
>>> [2] https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
>>> 
>>> [3] https://github.com/pallets/click/commit/b55294797ef32e22eb41e7d9657edb8faefa4976
>>> 
>>> 
>>> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
>>> ---
>>> .../python/python3-click/CVE-2026-7246.patch | 245 ++++++++++++++++++
>>> .../python/python3-click_8.1.7.bb | 5 +-
>>> 2 files changed, 249 insertions(+), 1 deletion(-)
>>> create mode 100644
>>> meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch
>>> 
>>> diff --git
>>> a/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch
>>> b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch
>>> new file mode 100644
>>> index 0000000000..47ee1a551f
>>> --- /dev/null
>>> +++ b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch
>>> @@ -0,0 +1,245 @@
>>> +From cb30f575b1a251e8698909bca2a443d41dad1824 Mon Sep 17 00:00:00 2001
>>> +From: Kevin Deldycke <kevin@deldycke.com>
>>> +Date: Wed, 4 Mar 2026 14:51:58 +0400
>>> +Subject: [PATCH] Document and fix command string sanitizing with
>>> `shlex.split`
>>> +
>>> +Removes last use of `shell=True` use for command invokation for
>>> defense-in-depth.
>>> +Refs: #1026, #1477 and #2775
>>> +
>>> +CVE: CVE-2026-7246
>>> +Upstream-Status: Backport [ https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494ebee4aef8f42
>>> ]
>>> +
>>> +Backport Changes:
>>> +- Click 8.1.7 uses Editor.edit_file(filename), not the newer
>>> + Editor.edit_files(filenames) API. Apply the argv-list change
>>> + to one filename without adding the multi-file API.
>>> +- Adapt editor tests from b96c2601 and follow-up b5529479 to
>> 
>> Hello,
>> 
>> This commit has both b96c2601 and b5529479 squashed. Please keep
>> upstream backport patches split.
>> 
>> Can you send a v2 with as the CVE fix (b96c2601) and its followup
>> (b5529479)?
>> 
>> Thanks!
>> 
>> --
>> Yoann Congal
>> Smile ECS
> 
> Hi Yoann,
> 
> While preparing v2, I noticed that NVD now marks CVE-2026-7246 as disputed
> and states that the Pallets Click project does not consider it a valid
> vulnerability:
> 
> https://nvd.nist.gov/vuln/detail/CVE-2026-7246
> 
> However, the published advisory identifies upstream commit b96c2601 as the
> fix:
> 
> https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
> 
> 
> Upstream describes the removal of shell=True as defense-in-depth, so I
> wanted to confirm the preferred handling. Should I replace the backport
> patches with a status entry such as:
> 
> CVE_STATUS[CVE-2026-7246] = "disputed: Pallets Click does not consider
> this a valid vulnerability"
> 
> Or should I continue with the split v2 backport patches as hardening?
> 
> Thanks,
> Darsh
> 

Hello, Yoann

I hope you are doing well. Could you please share if there are any updates on this?

Thanks,
Darsh

[-- Attachment #2: Type: text/html, Size: 4624 bytes --]