Log in Start free

Vulnerability · Published Apr 30, 2026 · Assigned by certcc

CVE-2026-7246[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

High 7.2

In plain English

A high-severity command injection in Click from Pallets Click. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.9%top 40.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-clickno fix listedDEBIAN-CVE-2026-7246
Debian:13python-clickno fix listedDEBIAN-CVE-2026-7246
Debian:14python-click8.3.3-1DEBIAN-CVE-2026-7246
PyPIclick8.3.3PYSEC-2026-2132
Ubuntu:22.04:LTSpython-clickno fix listedUBUNTU-CVE-2026-7246
Ubuntu:24.04:LTSpython-clickno fix listedUBUNTU-CVE-2026-7246
Ubuntu:25.10python-clickno fix listedUBUNTU-CVE-2026-7246
Ubuntu:26.04python-clickno fix listedUBUNTU-CVE-2026-7246

Affected products (as reported)

VendorProductVersions
Pallets Click Click 0 – before 8.3.3

Weakness: CWE-77, CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References