CVE-2026-7246: pallets click click Command Injection
Vulnerability summary
CVE-2026-7246 is a high (CVSS 7.2) Command Injection vulnerability in pallets click click. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 30-04-2026PublishedVulnerability first disclosed.
- 18-08-2026Last modifiedVulnerability information updated.
Description
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.2HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
- NVDNIST7.2HighCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
+0.02 pp
From 0.90% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSecurity Advisories
Maturity: poc
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Affected systems
Suse3 products
- python-click&distro=SUSE Linux Enterprise Server 16.0< 8.2.1-160000.3.1
- python-click&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 8.2.1-160000.3.1
- python-click&distro=SUSE Linux Micro 6.2< 8.2.1-160000.3.1
Opensuse2 products
- python-click&distro=openSUSE Leap 16.0< 8.2.1-160000.3.1
- python-click&distro=openSUSE Tumbleweed< 8.3.3-2.1
Debian1 product
- python-clickAll versions (No fix recorded) | < 8.3.3-1
Pallets click1 product
- click< 8.3.3
Palletsprojects1 product
- click< 8.3.3
PyPI1 product
- click< 8.3.3
Ubuntu1 product
- python-clickAll versions (No fix recorded)
7 vendors · 10 products
References
15 links- github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmwEVIDENCEREPORTExploitThird Party Advisory
