# CVE-2026-7246: Pallets Click command injection in click.edit

Source: https://junglewise.ai/threats/cve-2026-7246-pallets-click-command-injection-in-click-edit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-7246 · Severity: high · CVSS 7.2 · Published 2026-04-30

Pallets Click is a widely used Python library for creating command-line interfaces. A security flaw in its text-editing feature allows an attacker to execute unauthorized operating system commands if they can influence the filename being opened. This could lead to a full system compromise or unauthorized data access if a user is tricked into opening a specially crafted file using a tool built with this library.

Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-7246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7246 being exploited in the wild.

**How severe is CVE-2026-7246?** High severity, with a CVSS score of 7.2, published 30 April 2026.

**Which products and versions are affected?** click (PyPI) ECOSYSTEM:introduced=0,fixed=8.3.3.

**Is there a fix for CVE-2026-7246?** Yes. click (PyPI): upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7246 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-7246?** Check whether you run click (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- click (PyPI): upgrade to 8.3.3 or later

  ```sh
  pip install "click>=8.3.3"
  ```


## Technical details

A command injection vulnerability exists in the click.edit() function of the Pallets Click library due to improper neutralization of shell metacharacters in the filename parameter. The vulnerable component, edit_files(), wraps the filename in double quotes and passes it to subprocess.Popen() with shell=True enabled. An attacker can provide a filename containing a double-quote character to break out of the quoting context and inject arbitrary shell commands (e.g., 'filename"; <command>; echo "'). Exploitation requires the attacker to control the filename passed to the function and typically involves local access with high privileges and user interaction. The issue is fixed in version 8.3.3 by using shlex.split to handle arguments and disabling shell execution.

## Affected products

- Pallets Click <= 8.3.2
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10

## Identifiers

- CVE-2026-7246
- PYSEC-2026-2132

## Timeline

- 2026-04-22: patched: Version 8.3.3 released
- 2026-04-30: disclosed: Initial public disclosure and CVE assignment
- 2026-06-09: advisory: Red Hat published security advisories for Ansible Automation Platform

## References

- [https://github.com/pallets/click/releases/tag/8.3.3](https://github.com/pallets/click/releases/tag/8.3.3)
- [https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw](https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw)
- [https://access.redhat.com/errata/RHSA-2026:24761](https://access.redhat.com/errata/RHSA-2026:24761)
- [https://access.redhat.com/errata/RHSA-2026:24762](https://access.redhat.com/errata/RHSA-2026:24762)
- [https://access.redhat.com/security/cve/CVE-2026-7246](https://access.redhat.com/security/cve/CVE-2026-7246)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2464121](https://bugzilla.redhat.com/show_bug.cgi?id=2464121)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json)