CVE-2026-7246: 
Python vulnerability analysis and mitigation

CVE-2026-7246 is a command injection vulnerability in the click.edit() function of the Pallets Click Python library, affecting all versions prior to 8.3.3 (i.e., 8.3.2 and below). It allows an attacker who controls the filename parameter to inject and execute arbitrary OS commands. The vulnerability was published on April 30, 2026, and assigned by CERT/CC. It carries a CVSS v3.1 base score of 7.2 (High) (GHSA Advisory, Click Release).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerable code path in edit_files() wraps the user-supplied filename in double quotes and passes the resulting string to subprocess.Popen() with shell=True, without escaping internal double quotes or other shell metacharacters. An attacker-controlled filename containing a double-quote character (e.g., legitimate"; malicious_cmd; echo ") can break out of the quoting context and cause the shell to execute injected commands as separate statements. The fix in version 8.3.3 replaces shell=True with shlex.split() to construct proper argument lists for subprocess.Popen, eliminating the shell interpolation entirely (GHSA Advisory, Click Release).

Successful exploitation allows an unprivileged local user to execute arbitrary OS commands in the context of the application invoking click.edit(), with potential for full confidentiality, integrity, and availability compromise of the affected system. Vulnerable scenarios include supply-chain or plugin attacks where a malicious file triggers command execution when a developer opens it via a Click-based tool, as well as CLI or web applications that forward user-supplied filenames to click.edit() without sanitization. IBM Maximo Application Suite is also affected as a downstream consumer of the vulnerable library (GHSA Advisory, IBM Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub, demonstrating command injection by creating a marker file via shell metacharacter injection in the filename parameter (GHSA Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.026% (0.000260), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, high privileges, and user interaction, which limits the attack surface (Feedly Intelligence).

1. Identify a target application: Find a Click-based CLI or developer tool that passes externally-influenced filenames to click.edit() without sanitization, running Click version 8.3.2 or earlier.
2. Craft a malicious filename: Construct a filename containing a double-quote and shell metacharacters to break out of the quoting context, e.g., clickpoc"; touch /tmp/pwned; echo ".
3. Create the malicious file on disk: Use subprocess.run(['touch', malicious_filename]) or equivalent to create a file with the crafted name in the working directory.
4. Trigger click.edit(): Cause the target application to call click.edit(filename=malicious_filename), which internally invokes edit_files() and passes the unsanitized filename to subprocess.Popen(..., shell=True).
5. Observe command execution: The shell interprets the injected payload as a separate command (e.g., touch /tmp/pwned executes), confirming arbitrary OS command execution. More destructive payloads (reverse shells, data exfiltration) can be substituted in place of the benign touch command (GHSA Advisory).

• File System: Unexpected files created in the working directory or /tmp (e.g., marker files, web shells, or scripts) following invocation of a Click-based tool; files with names containing shell metacharacters (", ;, |, `).
• Process: Unusual child processes spawned by a Python process running a Click application (e.g., sh, bash, touch, curl, wget, python) with suspicious arguments; subprocess.Popen calls with shell=True in process audit logs.
• Logs: Application logs showing exceptions or unexpected output from click.edit() calls; OS audit logs (e.g., auditd) recording execution of unexpected commands by the application's user account.
• Network: Outbound connections from the host to unknown external IPs initiated by a Python/Click process, potentially indicating a reverse shell or data exfiltration payload (GHSA Advisory).

Upgrade Pallets Click to version 8.3.3 or later, which resolves the vulnerability by using shlex.split() to parse editor and pager commands into argument lists for subprocess.Popen with shell=False, eliminating shell interpolation (Click Release). For IBM Maximo Application Suite deployments, apply the corresponding IBM security patch referenced in IBM support node 7274207 (IBM Advisory). As an interim workaround where patching is not immediately possible, restrict local access to systems running vulnerable Click versions and ensure that no user-supplied or externally-influenced filenames are passed to click.edit() without strict allowlist validation.

The vulnerability was discovered and reported by security researcher @tsigouris007 in coordination with @kpatsakis and the CERT Coordination Center (CERT/CC), which issued the CVE (GHSA Advisory). Red Hat filed a Bugzilla entry (bug 2464923) and subsequently issued an errata (RHSA-2026:24761), and SUSE also published a security announcement for the affected package, indicating broad Linux distribution uptake of the fix. A German-language security article on Pro-Linux.de and a Portuguese-language blog post also covered the vulnerability, reflecting modest but international community awareness.