Kpatsakis

A command injection issue exists in the `click.edit()` function, which allows an unprivileged account to execute arbitrary operating system commands.

The `save external data()` function constructs an external-data file path using the `external data` location field and opens it for writing without using `O NOFOLLOW` or `O EXCL` flags, following a non-atomic `os.path.isfile()` check. A local attacker with write access to the directory where external data is serialized can create a symbolic link (symlink) that is followed by the application. This allows the attacker to cause the application to append data to any file the victim has permissions to write, such as application configurations, cron files, or `~/.ssh/authorized keys`.