CVE-2026-7246 Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

🗓️ 30 Apr 2026 13:16:44Reported by certccType

Pallets Click up to 8.3.2 has a command injection via unsanitized filename in click.edit(), enabling unprivileged command execution.

Reporter	Title	Published	Views	Family All 60
IBM Security Bulletins	Security Bulletin: Vulnerability pyopenssl, jackson-core, pyasn, log4j-core, handlebars, twisted, bcpkix-jdk18on, Mako, httpd, apache2-build, wheel, click, moment-timezone-with-data, urllib, pip July 2026	27 Jul 202616:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in click-8.1.8-py3-none-any.whl	13 May 202616:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.	5 Aug 202607:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by a command injection vulnerability due to Click	8 Jul 202610:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.	3 Aug 202609:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pallets Click bundled with IBM Fusion and IBM Fusion HCI	13 Jul 202619:49	–	ibm
IBM Security Bulletins	Security Bulletin:Pallets Click 8.3.2 Command Injection Vulnerability	4 Aug 202609:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-7246)	29 Jun 202612:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	12 Jun 202622:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:48	–	ibm

[
  {
    "vendor": "Pallets Click",
    "product": "Click",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "8.3.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
github	www.github.com/pallets/click/releases/tag/8.3.3

07 May 2026 16:41Current

EPSS0.009