CVE-2026-7246
Command Injection in Pallets Click
Publication date: 2026-04-30
Last updated on: 2026-04-30
Assigner: CERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| palletsprojects | click | to 8.3.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in Pallets Click versions 8.3.2 and below, specifically in the click.edit() function. It is a command injection flaw caused by unsanitized filenames being passed directly into a shell command. The vulnerable code constructs a command like "<editor> \"user-supplied-filename\"" and executes it using subprocess.Popen() with shell=True. An attacker can craft a filename containing special characters such as double quotes followed by malicious shell commands, which breaks out of the quoted context and allows execution of arbitrary OS commands.
This means that if an attacker can control the filename parameter passed to click.edit(), they can inject and execute unintended commands on the operating system, potentially compromising the system.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized execution of arbitrary OS commands, which can lead to compromise of confidentiality, integrity, and availability of the affected system.
- Confidentiality impact: Attackers may access sensitive data by executing commands.
- Integrity impact: Attackers can modify or delete files and data.
- Availability impact: Attackers may disrupt system operations or cause denial of service.
The vulnerability affects any application using click.edit() with externally controlled filenames, enabling supply-chain attacks, exploitation of web or CLI tools, or arbitrary command execution when files are opened.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves command injection through the click.edit() function when it is called with unsanitized filenames. Detection involves identifying usage of vulnerable Click versions (8.3.2 and below) and monitoring for suspicious command executions involving click.edit().
You can check the installed Click version with the following command:
- python -c "import click; print(click.__version__)"
To detect potential exploitation attempts, monitor logs or processes for suspicious shell commands that include unusual characters such as double quotes in filenames passed to click.edit().
Since the vulnerability arises from shell=True usage in subprocess.Popen with user-controlled filenames, you can also audit your codebase or running applications for calls to click.edit() and check if they are using vulnerable versions.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the Click library to version 8.3.3 or later, where the vulnerability has been fixed by removing the use of shell=True in subprocess calls within click.edit().
If upgrading immediately is not possible, avoid using click.edit() with externally controlled filenames or sanitize filenames to prevent injection of special characters like double quotes.
Additionally, restrict unprivileged accounts from invoking click.edit() or limit the ability to supply arbitrary filenames to this function.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The command injection vulnerability in Pallets Click versions 8.3.2 and below allows attackers to execute arbitrary OS commands, potentially compromising confidentiality, integrity, and availability of affected systems.
Such a vulnerability can lead to unauthorized access or manipulation of sensitive data, which may result in non-compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and health information.
Organizations using vulnerable versions of Pallets Click in their applications might face increased risk of data breaches or service disruptions, thereby impacting their ability to meet regulatory requirements for data security and privacy.