HOMEVULNERABILITIESCVE-2026-7246
HIGH

CVE-2026-7246

CWE-77Published: April 30, 2026· Updated: Apr 30, 2026

7.2
CVSS v3.1
EPSS:0.03%probability of exploitation in 30 daysPercentile:7.3th

Official Description

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

NVD Source

Technical Analysis

CVE-2026-7246 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.2.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityHigh
Privileges Req.High
User InteractionRequired
ScopeChanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected Vendors & Products

palletsprojects1 product
click
Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/pallets/click/releases/tag/8.3.3
ADVISORYhttps://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
ADVISORYhttps://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw

All References (3)

→
https://github.com/pallets/click/releases/tag/8.3.3Product · Patch
→
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmwExploit · Third Party Advisory
→
https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmwExploit · Third Party Advisory

Quick Facts

CVE IDCVE-2026-7246
CVSS Score7.2 / 10
SeverityHIGH
WeaknessCWE-77
CISA KEVNo
EPSS (30d)0.03%
Affected1 vendor
PublishedApr 30, 2026

Related CVEs (CWE-77)

CVE-2025-15379
10.0
CVE-2026-20186
9.9
CVE-2026-45663
9.9
CVE-2026-26068
9.9
CVE-2026-52806
KEV9.9
CVE-2026-20147
9.9

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2026-7246 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2026-7246·NVD