CVE-2026-7246

EUVD-2026-26375
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
LOCAL
HIGH
HIGH
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
palletsprojectsclick
𝑥
< 8.3.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/pallets/click/releases/tag/8.3.3
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw