CVE-2026-7246: Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
Other sources
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pallets Clickto a version that resolves this vulnerability.Fixed in 8.3.2 - Compensating control
Mitigate exploitation by ensuring unprivileged users cannot influence inputs to the click.edit() function (e.g., prevent attackers from providing/controlling filenames that reach click.edit()).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7246?
CVE-2026-7246 has a high severity level due to its potential for command injection attacks.
How do I fix CVE-2026-7246?
To fix CVE-2026-7246, upgrade Pallets Click to version 8.3.3 or later.
Which versions of Pallets Click are affected by CVE-2026-7246?
Pallets Click versions 8.3.2 and below are affected by CVE-2026-7246.
What types of attacks can CVE-2026-7246 enable?
CVE-2026-7246 can enable attackers to execute arbitrary OS commands on the vulnerable system.
Is user authentication required to exploit CVE-2026-7246?
No, CVE-2026-7246 can be exploited by attackers using unprivileged accounts.