Junglewise Threat Intelligence

CVE-2026-7246: Pallets Click command injection in click.edit

CVE-2026-7246 · Severity: high · CVSS 7.2 · Published 2026-04-30

Vendors: PyPI, Red Hat.

Executive brief

Pallets Click is a widely used Python library for creating command-line interfaces. A security flaw in its text-editing feature allows an attacker to execute unauthorized operating system commands if they can influence the filename being opened. This could lead to a full system compromise or unauthorized data access if a user is tricked into opening a specially crafted file using a tool built with this library.

Technical details

A command injection vulnerability exists in the click.edit() function of the Pallets Click library due to improper neutralization of shell metacharacters in the filename parameter. The vulnerable component, edit_files(), wraps the filename in double quotes and passes it to subprocess.Popen() with shell=True enabled. An attacker can provide a filename containing a double-quote character to break out of the quoting context and inject arbitrary shell commands (e.g., 'filename"; <command>; echo "'). Exploitation requires the attacker to control the filename passed to the function and typically involves local access with high privileges and user interaction. The issue is fixed in version 8.3.3 by using shlex.split to handle arguments and disabling shell execution.

Affected products

  • Pallets Click <= 8.3.2
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10

Timeline

  • 2026-04-22: patched: Version 8.3.3 released
  • 2026-04-30: disclosed: Initial public disclosure and CVE assignment
  • 2026-06-09: advisory: Red Hat published security advisories for Ansible Automation Platform

References