CVE-2026-7246: Palletsprojects Click

High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days.

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

Affected products

• Palletsprojects Click: before 8.3.3 (fixed in 8.3.3)

Published 2026-04-30. Last modified 2026-08-18.