Kpatsakis

**Name of the Vulnerable Software and Affected Versions** Pallets Click versions 8.3.2 and earlier **Description** A command injection issue exists in the `click.edit()` function, which allows an unprivileged account to execute arbitrary operating system commands. **Recommendations** Update to a version later than 8.3.2. As a temporary workaround, consider restricting the use of the `click.edit()` function.

**Name of the Vulnerable Software and Affected Versions** ONNX versions prior to 1.21.0 **Description** The `save external data()` function constructs an external-data file path using the `external data` location field and opens it for writing without using `O NOFOLLOW` or `O EXCL` flags, following a non-atomic `os.path.isfile()` check. A local attacker with write access to the directory where external data is serialized can create a symbolic link (symlink) that is followed by the application. This allows the attacker to cause the application to append data to any file the victim has permissions to write, such as application configurations, cron files, or `~/.ssh/authorized keys`. **Recommendations** Update to version 1.21.0.