{"id":"CVE-2026-7246","aliases":["PYSEC-2026-2132","GHSA-47fr-3ffg-hgmw"],"title":"Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pa…","summary":"Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","vendor":"click","product":"click","ecosystem":"pip","affected":["click < 8.3.3"],"patched":["click 8.3.3"],"published":"2026-04-30","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2132","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}],"tags":["osv","pip"],"epss":0.009,"epssPercentile":0.58136,"ingestedAt":"2026-07-13T18:58:07.487Z","slug":"CVE-2026-7246","body":"## Overview\n\nPallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.\n\n## Affected packages\n\n- `click < 8.3.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `click 8.3.3`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}