Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pallets/click
main @ 679a7a0
2
Fixes
2
CVEs
CRITICAL
Peak severity
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
click/_compat.py: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The click.edit() function previously invoked editor subprocesses using shell=True, enabling arbitrary command execution when handling untrusted filenames. Developers must ensure all subprocess spawning splits arguments safely and avoids shell execution.
Insecure Permissions: Atomic file saving operations could write files with insecure permissions. It is vital to explicitly calculate and apply permissions based on pre-existing files and active umasks during os.open and os.chmod calls.