Vulnerable Library - mkdocs-1.6.1-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/click-8.3.1.dist-info
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (mkdocs version) |
Remediation Possible** |
| CVE-2026-7246 |
 High |
7.2 |
click-8.3.1-py3-none-any.whl |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-7246
Vulnerable Library - click-8.3.1-py3-none-any.whl
Composable command line interface toolkit
Library home page: https://files.pythonhosted.org/packages/98/78/01c019cdb5d6498122777c1a43056ebb3ebfeef2076d9d026bfe15583b2b/click-8.3.1-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/click-8.3.1.dist-info
Dependency Hierarchy:
- mkdocs-1.6.1-py3-none-any.whl (Root Library)
- ❌ click-8.3.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-30
URL: CVE-2026-7246
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-30
Fix Resolution: https://github.com/pallets/click.git - 8.3.3,click - 8.3.3
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/click-8.3.1.dist-info
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - click-8.3.1-py3-none-any.whl
Composable command line interface toolkit
Library home page: https://files.pythonhosted.org/packages/98/78/01c019cdb5d6498122777c1a43056ebb3ebfeef2076d9d026bfe15583b2b/click-8.3.1-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/click-8.3.1.dist-info
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-30
URL: CVE-2026-7246
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-30
Fix Resolution: https://github.com/pallets/click.git - 8.3.3,click - 8.3.3