Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

...