HIGHCVE-2026-7246Published Modified CNA certcc
CVE-2026-7246: Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Metrics
- CVSS v3.1
- 7.2
- Severity
- HIGH
- Fixed in
- 8.3.3
- Affected Products
- 1
Fix available
8.3.3
Affected packages
- Pallets Click / Click< 8.3.3 (from 0)
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HReferences